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ABSTRACT 


Countering violent extremism (CVE) programs are moving into the realm of 
intervention, diversion, and deflection. These programs require mental health 
professionals to conduct assessments, construct treatment plans, and provide the 
treatment. How can practitioners treat or divert individuals from the path to radicalization 
but also communicate when an individual remains a threat? An understanding of the laws 
that facilitate or restrict disclosure of confidential health info, combined with a structure 
to oversee the process, is critical. Research for this thesis has focused on federal and 
Maryland state laws pertaining to medical record confidentiality and the duty to warn. 
This legal analysis has determined that exceptions exist within medical confidentiality 
laws, enabling mental health practitioners to disclose when a threat exists, and that 
Maryland’s duty-to-warn laws mandate that mental health practitioners have a duty to 
protect third parties from the actions of patients. Due to the varied disciplines involved in 
CVE, collaborative group models are suggested to structure the process. 
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EXECUTIVE SUMMARY 


As the threats of homegrown violent extremists have inereasingly beeome a 
reality, the federal government has ereated a countering violent extremism (CVE) 
program to fill the pre-criminal space. Elements of the CVE program are designed to add 
the missing preventative pieces to traditional methods. The four main parts of the U.S. 
CVE design are community engagement, education on radicalization, counter narratives, 
and intervention programs designed to deter or re-direct individuals from a path to 
radicalization. These parts are the same basic components of the most successful 
precursor models, namely gang diversioni and substance abuse diversion programs.2 

Eaw enforcement (EE) plays an integral role in CVE, but the effort also relies 
heavily on other participants and stakeholders. Mental health practitioners must play a 
critical role in both the intervention and education segments of CVE by providing 
essential services, detecting those at risk, and educating others on the radicalization 
process. While EE and mental health practitioners represent two professions dedicated to 
helping others, a mutual understanding or cooperation has historically been lacking.^ This 
conflict of perceived interests and obligations has slowed meaningful collaboration in the 
CVE intervention realm. 

How can mental health providers treat or divert individuals from the path to 
radicalization but still share risk assessments and intelligence with EE when patients pose 
a threat to others? CVE programs involved in intervention and diversion need a 
mechanism or policy in place that facilitates the notification of EE authorities when a 


1 James C. Howell, “Gang Prevention: An Overview of Research and Programs, Juvenile Justice 
Bulletin,” Office of Juvenile Justice and Delinquency Prevention, 2010, 12, http://eric.ed.gov/?id=ED 
518416. 

2 Jason Payne, Max Kwiatkowski, and Joy Wundersitz, Police Drug Diversion: A Study of Criminal 
Offending Outcomes, Research and Public Policy Series, no. 97 (Canberra: Australian Institute of 
Criminology, 2008), xi. 

2 James R. Corbin, “Confidentiality & the Duty to Warn: Ethical and Legal Implications for the 
Therapeutic Relationship,” The New Social Worker, April 23, 2014, 1, http://www.socialworker.com/ 
api/content/f6758ddl-7700-3ccb-95ab-96de65ea6fcd/. 

xiii 



diversion practitioner suspects that the client is not responding to diversion efforts or a 
determination is made that the individual presents a risk to others. 

The beginning steps involve an understanding of the legal environment that 
applies to the effort. Mental health practitioners are bound by federal and state laws that 
may restrict or facilitate the disclosure of privileged personal health information (PHI). 

A, MEDICAL RECORD CONFIDENTIALITY 

In reference to medical confidentiality laws, it is imperative that practitioners 
understand the existence of both the federal Health Insurance Portability and 
Accountability Act (HIPAA) law and specific state laws. In relation to HIPAA, 
stakeholders must understand that the HIPPA Privacy Rule only identifies two mandatory 
disclosures of PHI, to the patient, and to Department of Health and Human Services 
(DHHS) for auditing purposes. The remaining exceptions provide permissible conditions 
for mental health practitioners to share information. In terms of CVE, the two applicable 
exceptions to confidentiality when a mental health practitioner may disclose information 
are located in paragraphs (j) and (k) of the HIPAA Privacy Rule.^ Paragraph (J) allows a 
medical provider (mental health professional) to disclose PHI when it is “necessary to 
prevent or lessen a serious and imminent threat to the health and safety of a person or the 
public.”^ Paragraph (K) presents a broader exception to the federal law in that it allows 
for the disclosure of PHI to protect national security. The paragraph allows for the 
disclosure to “authorized federal officials” for the purpose of conducting “lawful 
intelligence, counter-intelligence, and other national security activities.”^ It is important 
to note that these exceptions to federal law are permissive and do not require the 
disclosure of PHI. It is clear, however, that mental health practitioners involved in 
intervention may, under federal law, disclose otherwise protected information if their 
client poses a threat of violence. 


^ U.S. Government, 45 CFR Part 164 Subpart E — Privacy of Individually Identifiable Health 
Information (Washington, DC: Government Printing Offiee, ad.), 764-765, aceessed August 6, 2016, 
https://www.gpo.gOv/fdsys/pkg/CFR-2007-title45-voll/pdf/CFR-2007-title45-voll-partl64-subpartE.pdf. 

5 Ibid., 764. 

6 Ibid., 765. 
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Like the Privacy Rule, Maryland state laws on medical record confidentiality are 
permissive in nature. Maryland law is broader than the federal law in regards with whom 
PHI may be shared. Maryland law allows for the disclosure of PHI to any government 
agency conducting authorized actions (as described by law). Practitioners will be 
challenged when blending state and federal law. Maryland law also allows for the release 
of information for an investigative process. The law does stipulate that the receiving 
agency must have written policies in place to protect the information. Many law 
enforcement (LE) agencies do not have written procedures for the protection and safe 
storing of PHI. As a result, LE agencies involved in CVE actions must create these types 
of policies. 

Practitioners in Maryland must also understand that they must disclose, or not 
disclose, PHI in compliance with the law to be immune from civil action. 

CVE programs may also use consent to share information. Consent is the easiest 
and cleanest practice that may address the issue of communication among stakeholders. 
The process must include a written waiver completed by the client. The waiver must 
include the length of the consent and under what circumstances it may be revoked. Under 
Maryland law, the consent process is described under §4-303.^ 

B, DUTY TO WARN AND PROTECT 

As with medical confidentiality laws, training on duty to warn and protect laws 
will be critical for practitioners involved in CVE intervention and diversion. Mental 
health professionals working with CVE programs should already be well versed on the 
ethical and legal conditions imposed upon their work. The practitioners may not, 
however, have experience working with other professionals from other disciplines. They 
also may not be well versed on the exceptions to confidentiality in relation to the threat 
presented by radicalized persons. 


^ State of Maryland, 22. Medical Records Act—Duty to Hold Confidential and Duty to Disclose a 
Medical Record, Health-General Article § § 4-301—4-309, 8-601 (Baltimore, MD: Maryland Department 
of Mental Health and Hygiene, n.d.), accessed September 12, 2016, http://dhmh.maryland.gov/psych/pdfs/ 
Medicalreports.pdf 
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The terms “duty to warn” and “duty to proteet” were born of a series of ineidents, 
and subsequent legal maneuvers, in California in the late-1960s and mid-1970s. The 
events of eoneem were litigated in the California ease of Tarasoff v. Regents of 
University of California.^ 

As duty to warn and duty to proteet laws reside at the state level, praetitioners 
must be aware of the laws of the state where they are praetieing. Additionally, many laws 
are written in a broad manner that does not elearly artieulate what is forbidden, mandated, 
or allowed. Many of these laws, sueh as Maryland’s, allow for diseretion. Mental health 
praetitioners must have aeeess to legal experts to assist in deeiphering and applying the 
law, whieh is espeeially important when situations are frequently not the same. 

Maryland is a mandatory duty-to-proteet state. The affirmative nature of the duty 
may differ from other states in that it provides for options for whieh a therapist may aet 
and does not speoifieally dietate whieh option the therapist must ehoose. The statute is 
loeated in Maryland’s Courts and Judieial Proeeedings Seetion §5-609.^ Seetion (b) 
outlines the mandated duty to proteet as oeeurrenees when a mental health eare provider 
is aware that a patient is eapable of violent behavior against a known vietim or group of 
vietims. The statue provides immunity from legal or diseiplinary aetion if the provider for 
diseharge of the duty to warn or proteet. Seetion (b) also deseribes the manner in whieh a 
provider may eome to know of the threat posed by a patient as the patient’s spoken word, 
writing, or eonduet.io 

Section (c) (2) provides the options for the discharge of the duty that a provider 
may take. The statue allows for discretion on the part of the provider to either seek a 
commitment for the patient, construct a treatment plan to address the potential violence, 
inform a LE agency of the danger posed by the patient, or warn the intended victim(s). If 


^ “Tarasoff v. Regents of University of California—17 Cal.3d 425—Thu, 07/01/1976|Califomia 
Supreme Court Resources,” accessed August 28, 2016, http://scocal.stanford.edu/opinion/tarasoff-v- 
regents-university-cahfomia-30278. 

^ “Courts and Judicial Proceedings, Section 5-609,” accessed September 10, 2016, http://mgaleg. 
maryland.gov/webmga/frmStatutesText.aspx?article=gcj&section=5-609&ext=html&session=2015RS& 
tab=subject5. 

10 Ibid. 



the provider dee ides to provide a warning to LE or the intended victim(s), the stature 
delineates that the warning must include the nature of the threat, the identity of the 
patient, and the identity of the intended victim(s). As a result, Maryland’s law is both a 
duty to warn and a duty to protect statute. The law is mandatory in requiring the therapist 
to take action to protect, but allows discretion in how the provider discharges the duty. 
The law also states that the actions taken by the provider must be both reasonable and 
timely. 

Mental health practitioners working with CVE programs within the state of 
Maryland are thus bound by state law to protect third parties from the actions of their 
clients. The law does, however, provide a certain amount of discretion in how the 
practitioner addresses the threat. Since CVE programs are collaborative efforts, mental 
health practitioners may rely on advice and input from other disciplines. 

C. CVE STRUCTURE MODELS 

The Building Resistance against Violent Extremism (BRAVE) model of CVE is 
currently operating in Montgomery County, Maryland, and is expected to expand to other 
jurisdictions. 12 

According to its strategic plan, the BRAVE model in Montgomery County 
describes itself as a “collective impact initiative” (CII).i2 “Collective Impact is a 
framework to tackle deeply entrenched and complex social problems. It is an innovative 
and structured approach to making collaboration work across government, business, 
philanthropy, non-profit organizations and citizens to achieve significant and lasting 
social change.”14 The idea of a CII was first written about in the Stanford Social 
Innovation Review in 2011. According to the article, five key elements are needed for a 

11 “Courts and Judicial Proceedings, Section 5-609.” 

12 World Organization for Resource Development and Education (WORDE), The Building Resilience 
against Violent Extremism (BRAVE) Model—A Collective Impact Initiative That Increases Public Safety 
and Social Cohesion (Montgomery Village, MD: World Organization for Resource Development and 
Education (WORDE), 2016, https://drive.google.eom/file/d/OB8ZeOqiUkpq2MUZlieTd5elJNKRVk/ 
view?usp=sharing&usp=embed_facebook. 

13 Ibid., 12. 

14 “The Collective Impact Framework | Collaboration for Impact,” accessed October 16, 2016, http:// 
www.collaborationforimpact.com/collective-impact/. 
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successful program: a common agenda, shared measurements systems, mutually 
reinforcing activities, continuous communication, and a backbone support organization. 


Common Agenda 

• Keeps all parties moving towards the same goal 

Common Progress Measures 

• Measures that gert to the TRUE outcome 

Mutually Reinforcing Activities 

• Each expertise is leveraged as part of the overall 

Communications 

• This allows a culture of collaboration 

Backbone Organization 

■ Takes on the role of managing collaboration 


Figure 1. Collective Impaet Initiative. 


CIIs are models that may be applied to organizational struetures to ensure that 
praetitioners are working together to aehieve a eommon goal. The BRAVE model is 
eurrently the only true community led CVE initiative in existenee. 

The BRAVE model also ealls for the ereation of an intervention task foree to 
oversee intervention efforts. While the task foree is not eurrently being used, it is 
envisioned to work in the same manner as a multi-diseiplinary team (MDT).!® The MDT 
approaeh identifies praetitioners with eritieal responsibilities to an issue, and brings those 
praetitioners together to form a team. The praetitioners represent ageneies that have a 
stake in the solution of the ehallenge. The praetitioners are brought together as subjeet 
matter experts on their aspeet or interest in the issue. The goal is to form a team of 
experts where eaeh expert represents a different diseipline for the purpose of 

“The Collective Impact Framework | Collaboration for Impact.” 

World Organization for Resource Development and Education (WORDE), The Building Resilience 
against Violent Extremism (BRAVE) Model—A Collective Impact Initiative That Increases Public Safety 
and Social Cohesion, 16. 
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collaborating on complex challenges. One of the assumptions of the effort is that 
individual practitioners would not benefit from the expertise of team members from 
different diseiplines if the team was not formed. The praetitioners represent eaeh of their 
diseiplines and work to eollaborate the efforts of their organizations with the partner 
ageneies. The goal is to ereate a eommon plan to overeome a ehallenge and identify the 
role of eaeh diseipline. MDTs have been used in the United Stated for several deeades, 
with a high level of sueeess, in the area of physieal and sexual ehild abuse. The MDT 
approaeh was first applied to ehild sexual abuse in the 1980s by the National Children’s 
Advoeaey Center (NCAC) in Huntsville, Alabama.MDTs are eurrently used in 
Montgomery County to eoordinate ehild abuse investigations. 

CVE programs should use struetural models similar to CIIs and MDTs to 
faeilitate the eooperation of stakeholders from different diseiplines. A strueture similar to 
a MDT is needed to manage the sereening and serviee plan of persons reeeiving 
assistanee in intervention programs. MDTs should be led by mental health praetitioners 
who possess the training and experienee needed to aeeess and manage treatment properly. 
The teams should also inelude legal professionals and LE to manage the balanee between 
sueeessful treatment and publie safety. 


“National Children’s Advocacy Center History,” accessed July 11, 2016, http://www.nationalcac. 
org/tab le/about/hi story/. 
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I. INTRODUCTION 


In Colorado, a seemingly normal and bright young girl was raised in a middle 
elass suburb of Denver. The daughter of a Catholie eollege professor, she took honors 
eourses at the loeal high sehool. She did not display troubling behavior, and enjoyed 
interaeting with her friends. She was like any number of other Ameriean teenagers. 

In her junior year, the girl—Shannon—began wearing traditional Muslim 
elothing. See Figure 1. On her Faeebook page, she ehanged her name from Shannon to 
Halima (Arabic for “gentle”). She began frequenting a Christian mega-church while 
wearing her traditional Muslim clothing. i 



^ Jenny Deam, “Colorado Woman’s Quest for Jihad Baffles Neighbors,” Latimes.com, July 25, 2014, 
http ://www. latimes.eom/nation/la-na-high-school-j ihadi-20140726-story.html. 

2 Source: TheDenverChannel.com Team, “Shannon Conley, Arvada Teen Who Tried to Join ISIS to 
Wage Jihad, Sentenced to 4 Years in Prison,” 7NEWS, January 24, 2015, http://www.thedenverchannel. 
com/news/local-news/sentencing-for-shannon-conley-arvada-teen-who-tried-to-join-isis-to-wage-jihad. 


1 




Church officials approached the young woman and inquired if she had questions 
or was interested in joining the ehureh; she replied that she was Muslim and was there to 
eonduet researeh. Shortly thereafter, the Federal Bureau of Investigation (FBI) was 
notified and eondueted their first interview of Shannon Maureen Conley.3 

Nothing Conley was doing was illegal; but she was in the proeess of radiealizing 
to Islamie extremism. She had been watehing DVDs of Anwar al-Awlaki and other 
jihadists.4 Conley met an Islamie State (IS) jihadist on-line, and agreed to travel to the 
Middle East to marry him and join him in waging jihad. She was also apparently pursuing 
military-style taetieal training. Her parents, aware of her plans, were alarmed. 

The FBI interviewed Conley eight times over the eourse of five months. Six of the 
interviews were eondueted with her parents present. Agents pleaded with Conley to 
abandon her radieal views of Islam. ^ The agents also beseeehed her parents to dissuade 
her from eommitting any erimes or traveling to join a terror group. On April 8, 2014, 
shortly after the FBI’s last eonversation with Conley, she was arrested at Denver 
International Airport, en route to Turkey and then Syria. Conley was eharged federally 
with providing material support to a terrorist group. 

In January 2015, a federal judge senteneed Conley to four years in prison after she 
admitted to trying to travel to Syria to join the IS. The judge who senteneed her stated 
that he believed she needed psyehiatrie eare, but also noted that she had remained defiant 
and possibly dangerous. “Added the judge. She has no history in the eriminal justiee 
system. She is very young...Teenagers make dumb deeisions a lot.”^ At senteneing, 
Conley elaimed that she had been wrong and now understood that Islamie State of Iraq 
and Syria (ISIS) had eorrupted Islam and the Quran. Proseeutors argued for the four-year 
sentenee to dissuade others from taking a similar path. 

3 TheDenverChannel.com Team, “Shannon Conley, Arvada Teen Who Tried to Join ISIS to Wage 
Jihad, Sentenced to 4 Years in Prison.” 

Michael Martinez, Ana Cabrera, and Sara Weisfeldt, “Colorado Woman Gets 4 Years for Wanting to 
Join ISIS,” CNN, January 24, 2015, http://www.cnn.eom/2015/01/23/us/colorado-woman-isis-sentencing/ 
index.html. 

3 Beam, “Colorado Woman’s Quest for Jihad Baffles Neighbors.” 

3 Martinez, Cabrera, and Weisfeldt, “Colorado Woman Gets 4 Years for Wanting to Join ISIS.” 
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The greatest irony of the Shannon Conley ease is that both her family and the FBI 
were aware of her aetivities and took steps to try and eonvince her from eontinuing on her 
path, and it was not enough. It is perfectly legal in the United States to be vulnerable to 
radicalization to violent extremism, to radicalize, or even to express radical beliefs. For 
this reason, authorities undertake investigative or prosecutorial activities only once a 
crime has been committed. The problem is not, in the first instance, that authorities fail to 
recognize or track would-be terrorists and their plans. Law enforcement (LE) and 
intelligence communities around the world are aware of individuals who pose a possible 
danger to society but who have not committed a crime, or at least a crime the government 
wished to prosecute. French officials, for example, were aware of the suspect brothers 
who committed the Charlie Hebdo attacks and murders in Paris in 2015. The government 
conducted surveillance, but the brothers were not observed committing any crimes, so the 
authorities turned their attention to other potentially violent suspects. It turned out that the 
brothers were planning mass murder, but they had not revealed any suspicious signs 
during the course of the government’s investigation.^ Similarly, the homegrown violent 
extremist (HVE) who committed murder at an Orlando nightclub had twice previously 
been investigated by the EBI.^ When the EBI exhausted all plausible investigative efforts, 
agents had no choice but to let this future killer go. The EBI and other federal EE 
agencies are restricted in their options in advance of a criminal act by a process that 
regulates their ability to open formal investigations, and limits the length of the 
investigation. 

As the threats of HVE have increasingly become a reality, the federal government 
has created a countering violent extremism (CVE) program to fill the pre-criminal space. 
Elements of the CVE program are designed to add the missing preventative pieces to 
traditional methods. The four main parts of the U.S. CVE design are community 
engagement, education on radicalization, counter narratives, and intervention programs 


^ Scott Bronstein, “Cherif and Said Kouachi: Their Path to Terror,” CNN, January 14, 2015, http:// 
www.cnn.com/2015/01/13/world/kouachi-brothers-radicalization/index.html. 

^ Del Quentin Wilber, “The FBI Investigated the Orlando Mass Shooter for 10 Months—and Found 
Nothing. Here’s Why,” Latimes.com, July 14, 2016, http://www.latimes.com/nation/la-na-fbi-investigation- 
mateen-20160712-snap-story.html. 
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designed to deter or re-direct individuals from a path to radicalization. These parts are the 
same basic components of the most successful precursor models, namely gang diversion^ 
and substance abuse diversion programsd^ 

LE plays an integral role in CVE, but the effort also relies heavily on other 
participants and stakeholders. Mental health practitioners must play a critical role in both 
the intervention and education segments of CVE by providing essential services, 
detecting those at risk, and educating others on the radicalization process. While EE and 
mental health practitioners represent two professions dedicated to helping others, a 
mutual understanding or cooperation has historically been lacking, n EE is frequently a 
profession charged with gathering information, and the field of mental health is generally 
a profession ethically and legally bound to protect the confidentiality of its patients. This 
conflict of perceived interests and obligations has slowed meaningful collaboration in the 
CVE intervention realm. 

A. RESEARCH QUESTION 

How can mental health providers treat or divert individuals from the path to 
radicalization but still share risk assessments and intelligence with EE when patients pose 
a threat to others? CVE programs involved in intervention and diversion need a 
mechanism or policy in place that facilitates the notification of EE authorities when a 
diversion practitioner suspects that the client is not responding to diversion efforts or a 
determination is made that the individual presents a risk to others. What should such a 
policy comprise? 


^ James C. Howell, “Gang Prevention: An Overview of Research and Programs. Juvenile Justice 
Bulletin,” Office of Juvenile Justice and Delinquency Prevention, 2010, 12, http://eric.ed.gov/?id=ED518 
416. 

Jason Payne, Max Kwiatkowski, and Joy Wundersitz, Police Drug Diversion: A Study of Criminal 
Offending Outcomes, Research and Public Policy Series, no. 97 (Canberra: Australian Institute of 
Criminology, 2008), xi. 

11 James R. Corbin, “Confidentiality & the Duty to Warn: Ethical and Legal Implications for the 
Therapeutic Relationship,” The New Social Worker, 1, April 23, 2014, http://www.socialworker.com/api/ 
content/f6758ddl-7700-3ccb-95ab-96de65ea6fcd/ 
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B, PROBLEM STATEMENT 

The United States has adopted CVE as a preventative aspeet of its 
counterterrorism strategy. In 2011, the U.S. government issued a report titled, 
Empowering Local Partners to Prevent Violent Extremism in the United States The 
report documents the government’s position that traditional efforts, including diplomatic 
relations, military action, intelligence gathering and analysis, and investigative and 
prosecutorial processes, were deemed insufficient in preventing and deterring HVEs in 
the homeland. 13 CVE programs are focused on building trusting relationships between 
the government and the communities they serve, training practitioners and community 
members on radicalization and terrorism, countering the narratives of violent jihad, 
providing an deflection or diversion application to redirect individuals at-risk or engaged 
in the radicalization process, and providing an intervention element to assist individuals 
who may be at risk for radicalization. 

1. Intervention, Deflection, and Diversion 

George Washington University Professor Dr. Eorenzo Vidino divides the 
categories of radicalization into two parts. According to Vidino: 

Cognitive radicalization is the process through which an individual adopts 
ideas that are severely at odds with those of the mainstream, refutes the 
legitimacy of the existing social order, and seeks to replace it with a new 
structure based on a completely different belief system. Violent 
radicalization occurs when an individual takes the additional step of using 
violence to further the views derived from cognitive radicalization. 


13 Executive Office of the President of the United States, Empowering Local Partners to Prevent 
Violent Extremism in the United States (Washington, DC: Executive Office of the President of the United 
States, 2011), https://www.whitehouse.gov/sites/default/files/empowering_local_partners.pdf 

13 Ibid., 2. 

I'l Executive Office of the President of the United States, Strategic Implementation Plan for 
Empowering Local Partners to Prevent Violent Extremism in the United States (Washington, DC: 
Executive Office of the President of the United States, 2011), https://www.whitehouse.gov/sites/ 
default/files/sip-final.pdf 

13 Lorenzo Vidino and James Brandon, Countering Radicalization in Europe (London: International 
Centre for the Study of Radicalization and Political Violence, 2012), 9-10. 
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Vidino’s assertion describes the difference between an individual who is radicalized and 
an individual who is radicalized and involved in illegal or violent activities. 

Intervention programs are designed to provide services for individuals who are 
vulnerable to radicalization; these people might be immigrants who are having a hard 
time adjusting to a new culture, or teenagers experiencing social difficulties. Deflection 
and diversion programs are designed for individuals involved in the radicalization 
process. Diversion programs are designed to be in lieu of incarceration after or during a 
prosecution. Deflection programs are used “when a law enforcement agency is aware of 
the subject but instead of prosecution or before a crime is committed, the individual is 
referred to an intervention program.”!^ 

According to the strategic plan issued by the World Organization for Resource 
Development and Education (WORDE) for the Building Resilience Against Violent 
Extremism model of CVE; 

Both diversion and deflection programs attempt to divert or channel 
offenders away from the justice system by providing intense wrap-around 
services, including counseling, mentoring, case management, and 
community service opportunities. Such programs are often conducted in 
partnership with police departments, courts, district attorneys, or non¬ 
governmental agencies in lieu of incarceration or prosecution and often 
require reporting compliance to the referring agency. 

Eor the purpose of this thesis, collectively, all three are referred to as 
“intervention.” “Intervention efforts are typically provided by trained, experienced, and 
licensed mental health practitioners. These experts include social workers, clinicians. 


World Organization for Resource Development and Education (WORDE), The Building Resilience 
against Violent Extremism (BRAVE) Model—A Collective Impact Initiative That Increases Public Safety 
and Social Cohesion (Montgomery Village, MD: World Organization for Resource Development and 
Education (WORDE), 2016, 19, littps://drive.google.com/file/d/OB8ZeOqiUkpq2MUZlieTd5elJNKRVk/ 
view?usp=sharing&usp=embed_facebook. 

17 Ibid. 
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therapists, psychiatrists, and psychologists. (Referrals for intervention also come from the 
community and government.)”!^ 

Clinicians and therapists involved in intervention efforts are bound by ethical and 
legal obligations to maintain the confidentiality of the persons they are treating. As a 
result, legal restrictions may be in place prohibiting or mandating the notification of LE. 
On the other hand, a situation may emerge in which the therapists may be assessing a 
client who has been referred for intervention without recognizing clues that may indicate 
that the client poses a risk to the rest of society. In such a scenario, communication 
between diversion and intervention practitioners and LE sources may be crucial. 

2. Medical Record Confidentiality 

Practitioners may be affected and limited in their ability to disclose client or 
patient information by federal HIPAA laws and state statutes directed towards medical 
record confidentiality. 20 HIPAA and state laws were created to protect patients’ privacy 
rights, but they also provide for exceptions to fulfill crucial LE and public health 
functions. Some of the exceptions to confidentiality and privacy laws include responses 


The community referrals may come from “bystanders,” defined as individuals who are close, or in 
contact with, an individual who is at risk or engaged in a radicalization process. See Thomas Schillinger, 
“Bystander Effect and Religious Group Affiliation: Terrorism and the Diffusion of Responsibility” (PhD 
diss., Walden University, 2014), http://scholarworks.waldenu.edU/dissertations/126/.Bystanders maybe 
family members, friends, co-workers, religious associates, or neighbors. When bystanders make a referral 
to a CVE for diversion, the presence and identity of the individual referred may, or may not, be known to 
government authorities. Mechanisms and processes may not be in place to facilitate notification of LE 
when the referred individual presents a threat. Examples of intervention referrals originating from 
government sources are court referrals, juvenile justice systems referrals, referrals from LE (i.e., a referral 
from a school resource officer), referrals from Health and Human Services agencies, referrals from schools, 
and referrals directly from terrorism investigative agencies, such as the FBI and the FBI’s Joint Terrorism 
Task Forces (JTTF).Typically, in cases where the referral originates from an investigative agency, an 
investigation has been conducted and a determination has been made that no charges or prosecution will 
take place at the time of the referral. This finding does not ensure that the target of the investigation does 
not pose a risk, that the investigation will not continue, or that charges will not be placed in the future. 

!!! Corbin, “Confidentiality & the Duty to Warn: Ethical and Legal Implications for the Therapeutic 
Relationship.” 

20 “When Does the Privacy Rule Allow Covered Entities to Disclose Protected Health Information to 
Law Enforcement Officials?,” accessed September 19, 2015, http://www.hhs.gov/ocr/privacy/hipaa/faq/ 
disclosures_for_law_enforcement_purposes/505.html. 
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to court orders, mandated reporting of sexual or physieal abuse, and notifieation of when 
a patient dies.^i 

Various federal laws define the government’s role and responsibilities in regards 
to national security (i.e., the National Seeurity Aet and the Patriot Aet). These laws define 
terms and delineate the eireumstances in whieh a practitioner may report behavior that 
endangers national seeurity .22 For example. Section 215 of the PATRIOT Aet describes 
the proeess through whieh the federal government may require praetitioners to provide 
the FBI with evidenee of national intelligenee, eounter-intelligence, or national seeurity 
implications .23 


3, Confidentiality versus Public Peril 

State laws inspired by the 1974 and 1976 Tarasoff vs. Regents case in California 
affeet clinicians and their duty to warn or protect when they are treating a client who 
poses a risk to others.24 It is from the Tarasoff ease that the terms “duty to warn” and 
“duty to proteet” originate.25 Tarasoff was the first case to explore the balance between a 
patient’s right to eonfidentiality and a therapist’s obligation to warn third parties of 
potential danger posed by the elient.26 The requirement, whieh has been adopted and 
applied by most states, requires that psyehotherapists with information that a client they 
are treating poses a threat to someone else make reasonable efforts to eommunicate with 


21 “When Does the Privacy Rule Allow Covered Entities to Disclose Protected Health Information to 
Law Enforcement Officials?.” 

22 F. Sensenbrenner, “H.R.2048—114th Congress (2015-2016): USA FREEDOM Act of 2015,” June 
2, 2015, https://www.c 0 ngress.g 0 v/bill/l 14th-congress/house-bill/2048/text. 

23 “National Security and Medical Information,” accessed March 26, 2016, https://www.efforg/ 
issues/national-security-and-medical-information. 

24 Tarasoff v. Regents of the University of California, 17 Cal. 3d 425 (1976). 

25 Steven Granich, “Duty to Warn, Duty to Protect,” SocialWorker.com, accessed February 27, 2016, 
http://www.socialworker.corn/api/content/a89ea5ac-f455-31d0-b88f-d814ca06299f/. 

26 Damon Muir Walcott, Pat Cerundolo, and James C. Beck, “Current Analysis of the Tarasoff Duty: 
An Evolution towards the Limitation of the Duty to Protect,” Behavioral Sciences & the Law 19, no. 3 
(June 2001): 325-43, doi:10.1002/bsl.444. 


8 



and warn the victim and a LE agency. Since duty to warn and protect laws reside at the 
state level, each state has a unique law that applies the duty differently. 


C. HYPOTHESIS 

CVE intervention, deflection, and diversion programs need mental health 
practitioners to conduct an assessment, construct a treatment plan, and provide treatment. 
The effort needs to be coordinated among professionals from various fields. 
Relationships and communication between the professionals are critical. The solution 
includes an understanding of the laws that facilitate or restrict disclosure of confidential 
health information combined with structured teams to oversee the process. 

In Montgomery County, Maryland, detectives assigned to the County Police 
Department’s Special Victim Investigative Division Child Abuse Units work hand in 
hand with social workers from the County’s Child Protective Services division. The 
detectives and social workers conduct joint investigations into the reports of physical and 
sexual child abuse. In some cases, where the victim is younger, the specially trained 
social workers conduct the interview of the victim. The social workers and detectives are 
also part of a larger team of practitioners who all have an interest in the investigation and 
coordination of services to the victims and their families. The larger team includes 
specially trained medical personnel (pediatrician and nurse), prosecutors from the state’s 
attorney’s office, and lawyers from the county attorney’s office. The team meets once a 
week (as needed) to collaborate on cases that need special attention. The meetings, called 
“multi-d’s,” are the formal collaborative efforts of an entire multi-disciplinary team. 
Members, who have identified an issue, or problem, call the meeting to bring together the 
collective expertise of the members to solve any issues. During the meeting, members 
work together to identify issues and create solutions. Over the years, the members of the 
teams have developed a strong working relationship, which has led to an understanding 
and appreciation for the roles of the other members of the team. 


27 Bonnie R. Benitez, “Confidentiality and Its Exceptions (including the U.S. Patriot Act),” The 
Therapist 16, no. 4 (2004): 32-36. 
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Collaborative efforts designed to address eomplex issues frequently organize into 
struetures that have proven to overeome ehallenges. CIIs and multi-diseiplinary teams 
(MDTs) are two examples of sueh struetures. Eaeh model was designed to bring together 
praetitioners from different diseiplines to aeeomplish a shared goal. The struetures 
faeilitate a mutual understanding of roles and ensure eommunieation and eooperation 
between the different elements of the group, thus ensuring a higher probability of 
sueeess. CIIs are best deployed at the organization level, and MDTs are best utilized at 
the sub-group level. CVE programs should analyze the eoneepts inherent in both 
programs. CVE programs may benefit from the strueture of a CII. Smaller working 
groups, sueh as those managing and faeilitating intervention efforts, should operate as a 
MDT. The eollaborative group and the tenets of the strueture should then be used to 
ensure proper training on laws and polieies applieable to the overall missions of the 
program. 

Although the response to ehild abuse and radiealization are different, it is possible 
to apply methods that have proven sueeessful to CVE. CIIs and MDTs may be used to 
identify and solidify roles, ereate trusting partnerships, study poliey, and manage the 
sereening and ereation of treatment plans for elients in CVE intervention programs. The 
use of a MDT to oversee efforts would ensure that all members of the team were 
edueated on the laws that apply to the effort, and that proper eommunieation between 
team members oeeurred. The strength of the model lies in the melting together of 
different diseiplines that all have a role in the effort. 

Onee praetitioners have formed into CIIs and MDTs, the identifieation and 
exeeution of roles and responsibilities may begin. Eegal experts may begin determining 
the path forward and polieies may be eonstrueted. As the effort progresses and additional 
issues arise, a team of experts would already exist to analyze and address the issues. 

D, LITERATURE REVIEW 

The U.S. CVE program was designed to apply to loeal levels of government with 
the support of the federal government. The main goal of the program is to “prevent 
violent extremists and their supporters from inspiring, radiealizing, finaneing, or 
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recruiting individuals or groups in the United States to commit acts of violence.”^8 In 
locations where CVE programs exist, not all aspects of the program have been 
implemented. As a result, a fair amount of research has been conducted on CVE in 
general, but little current research is available on CVE programs presently in place, and 
specifically, no research on CVE intervention or diversion programs. The lack of metrics 
associated with measuring the success of CVE programs, and the need for continuous 
studies on CVE efforts have been raised by researchers.^9 

As threats against the homeland develop, the response to those threats evolves. As 
a result, the landscape is constantly changing. This literature review is divided into the 
following categories: 

• The U.S. CVE program 

• Current CVE models 

• National security laws and confidentiality 

• The multidisciplinary approach 

1. U.S. CVE Program 

The 2011 federal government report titled. Empowering Local Partners to 
Prevent Violent Extremism in the United States, defines violent extremists as “individuals 
who support or commit ideologically-motivated violence to further political goals.” The 
report identifies the central goal of CVE as “prevent[ing] violent extremists and their 
supporters from inspiring, radicalizing, financing, or recruiting individuals or groups in 
the United States to commit acts of violence.”3i 


28 Executive Office of the President of the United States, Empowering Local Partners to Prevent 
Violent Extremism in the United States. 

29 NaureenChowdhury Fink, Peter Romaniuk, and RafiaBarakat, Evaluating Countering Violent 
Extremism Programming: Practice and Progress (New York: Center on Global Counterterrorism 
Cooperation, 2013), http://globalcenter.org/wp-content/uploads/2013/07/Fink_Romaniuk_Barakat_ 
EVALUATING-CVE-PROGRAMMING_20132.pdf 

20 Executive Office of the President of the United States, Empowering Local Partners to Prevent 
Violent Extremism in the United States, 1. 

31 Ibid., 3. 
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Several months later, the federal government issued a seeond report, titled. The 
Strategic Implementation Plan (SIP) for Empowering Local Partners to Prevent Violent 
Extremism in the United States The SIP identified a three-part strategy to implement 
CVE programs as inereasing support for loeal communities, expanding governmental 
knowledge, and providing counter-narratives.33 These two reports provide a roadmap of 
the federal government’s intent for its CVE program. These types of reports issued 
directly by the federal government are primary sources; the remaining, secondary 
literature, provides an analysis and evaluation of the plans. 

Many of the sources that provide an analysis of the federal CVE program have 
come to similar conclusions and have identified similar criticisms, or areas of interest in 
which lie opportunities for improvement. The fact that different experts who represent a 
variety of organizations have drawn the same conclusions may lend a certain amount of 
credibility to the findings. Eor example, a report issued by the federal Congressional 
Research Service (CRS) and a report issued by the Heritage Eoundation both recognized 
that the federal government had not selected a lead agency for the implementation and 
management of CVE, and that it was an area of concern that needed to be addressed.34 In 
this case, both a federal agency and a non-govemmental organization (NGO) arrived at 
the same conclusion in regards to CVE. Since then, the federal government has 
consolidated many of its efforts under the Department of Homeland Security (DHS). 
Other federal agencies, such as the FBI and the U.S. Attorney’s Office, are still involved 
in different areas. 

Virtually all the research on CVE identifies problem areas within the model and 
its implementation: a lack of funding, an absence of a lead agency, the lack of a clear 
definition for CVE, hurdles associated with community engagement and trust, the 

32 Executive Office of the President of the United States, Strategic Implementation Plan for 
Empowering Local Partners to Prevent Violent Extremism in the United States, 2011. 

33 Ibid. 

34 Jerome P. Bjelopera, Countering Violent Extremism in the United States (CRS Report No. R42553) 
(Washington, DC: Congressional Research Service, 2012), http://digital.hbrary.unt.edU/ark:/67531/metadc 
87235/ml/l/high_res_d/R42553_2012May31.pdf; David Inserra, “Revisiting Efforts to Counter Violent 
Extremism: Leadership Needed,” The Heritage Foundation, April 20, 2015, http://www.heritage.org/ 
research/reports/2015/04/revisiting-efforts-to-counter-violent-extremism-leadership-needed. 
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stigmatization of the Muslim community, a lack of effort aimed at other populations 
vulnerable to radicalization, and a lack of empirical research to provide policy makers 
with information for decision making. 

Since September 11, 2001, the United States has experienced acts of violence 
committed by individuals who have been radicalized to violent extremism. According to 
a report issued by the CRS, an estimated 63 homegrown violent jihadist plots or attacks 
have occurred in the United States between September 11, 2001 and 2013.35 

Many of the individuals who committed these acts were considered HVEs who 
had undergone a radicalization process. According to Bjelopera, “‘homegrown’ is the 
term that describes terrorist activity or plots perpetrated within the United States or 
abroad by American citizens, legal permanent residents, or visitors radicalized largely 
within the United States.”3^ 

In this context, radicalization refers to the process in which an individual acquires 
and internalizes extremist or jihadist beliefs.37 Experts agree that the process of 
radicalization may contain some similarities for some individuals, but that currently no 
solid pattern exists since it is an individualized event. The process may be affected by 
outside influences, such as intermediaries, social networks, the Internet, or contact with 
others in prison. 38 Even though the radicalization process is unique to each individual, 
case studies are beneficial to identifying markers displayed by other individuals in the 
process of radicalizing. 

“The term ‘jihadist’,” notes Bjelopera, “describes radicalized individuals using 
Islam as an ideological and/or religious justification for their belief in the establishment 
of a global caliphate, or jurisdiction government by a Muslim civil and religious leader 


35 Jerome Bjelopera, American Jihadist: Terrorism Combating a Complex Threat (CRS Report No. 
R41416) (Washington, DC: Congressional Researeh Serviee, 2013), 1, https://www.fas.org/sgp/ers/terror/ 
R41416.pdf 

36 Ibid. 

37 Ibid. 

38 Ibid., 2. 
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known as a caliph.”39 The federal government defines violent extremists as “individuals 
who support or commit ideologically-motivated violence to further political goals.”^0 
Examples of terror acts committed by homegrown individuals who had radicalized to 
extremist violence include the Fort Hood shooting and the Boston Marathon bombing. 

Historically, the government’s response to terrorist acts committed or planned on 
U.S. soil has involved traditional LE and intelligence activities. These activities include 
gathering and analyzing information, traditional investigative techniques, and 
prosecutions. These efforts are conducted by EE and intelligence agencies at the federal, 
state, and local levels. According to a 2010 report by the RAND Corporation; 

Traditional law enforcement, in which authorities attempt to identify and 
apprehend a perpetrator after a crime has been committed, is inadequate to 
deal with terrorists who are determined to cause many deaths and great 
destruction and who may not care whether they themselves survive. Public 
safety demands a more preventative approach, intervention before an 

attack occurs."^2 

In October 2016, the U.S. government released an updated SIP, which addresses 
many of the broad criticisms of the CVE program.43 The 2016 SIP re-enforces the goals 
of CVE programs, and states, “The overall goal of the Strategy and United States 
Government efforts to implement it remains unchanged: to prevent violent extremists and 
their supporters from inspiring, radicalizing, financing, or recruiting individuals or groups 


39 Ibid., 1. 

Executive Office of the President of the United States, Empowering Local Partners to Prevent 
Violent Extremism in the United States, 1. 

For more information on these events, please refer to Joseph Lieberman and Susan Collins, A 
Ticking Time Bomb Counterterrorism Lessons from the U.S. Government’s Failure to Prevent the Fort 
Hood Attack (Washington, DC: U.S. Senate Committee on Homeland Security and Governmental Affairs, 
2011), http://fas.org/irp/congress/201 I rpt/hsgac-hood.pdf; “Boston Marathon Bombings,” accessed July 8, 
2015, http://www.boston.com/news/locaFmassachusetts/specials/boston_marathon_bombing/. 

Brian Michael Jenkins, Would-Be Warriors: Incidents ofJihadist Terrorist Radicalization in the 
United States since September 11, 2007 (Santa Monica, CA: RAND, 2010), viii, http://www.rand.org/ 
content/dam/rand/pubs/occasional_papers/2010/RAND_OP292.pdf. 

^^3 Executive Office of the President of the United States, Strategic Implementation Plan for 
Empowering Local Partners to Prevent Violent Extremism in the United States (Washington, DC: 

Executive Office of the President of the United States, 2016), https://www.whitehouse.gov/sites/default/ 
files/docs/2016_strategic_implementation_plan_empowering_local_partners_prev.pdf 
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in the United States to eommit acts of violence.The current SIP also recognizes that 
no single path to radicalization is followed and the phenomenon is not exclusive to any 
one population, religion, or cause. The introduction to the current SIP also provides 
clarity to the term “stakeholder” in relation to CVE programs. The document describes 
stakeholders as persons who have an “expressed or identified role” in CVE and may 
include EE, members of the public, NGOs, researchers, members of the education field, 
mental health practitioners, and efforts provided by private-sector experts.^^ 

The new SIP addresses previous criticism of the federal CVE model’s lack of a 
lead agency by assigning a DHS task force as the lead government agency in 
coordinating research and the dissemination of information. “Its work is organized into 
four lines of effort: Research and Analysis; Engagement and Technical Assistance; 
Interventions; and Communications and Digital Strategy.”^6 

The current SIP identified intervention as one of the four areas of concentration 
for the DHS task force. The document states that the task force, “will coordinate the 
development and dissemination of resources describing possible warning signs as well as 
steps families and friends can take if they believe someone close to them is becoming 
recruited or radicalized to violence.”47 

Counter-radicalization programs are typically divided into three different types of 
efforts: prevention (intervention), disengagement (deflection), and de-radicalization 
(diversion). Prevention involves education and counter-narrative efforts designed to stop 
the radicalization process before it begins. These efforts may involve an intervention 
aspect for individuals who have been referred to a program after a determination has been 
made that the individual may be vulnerable or susceptible to a radicalization process. 
Disengagement or deflective efforts are designed to provide an “off ramp” for individuals 
engaged in a radicalization process. De-radicalization or diversion programs are designed 


44 Ibid., 1. 

45 Executive Office of the President of the United States, Empowering Local Partners to Prevent 
Violent Extremism in the United States, 1. 

46 Ibid., 2. 

47 Ibid., 11. 
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to lead a radicalized individual to abandon violent or deviant views and return to regular 
society. A successful outcome of disengagement and de-radicalization activities may 
include an individual maintaining radical views, but abandoning violent activities.^s All 
these activities and phases fall under the general rubric of “intervention.” 

2. Current CVE Models 

Several years after the U.S. government began planning a CVE program, efforts 
stalled. After the Boston Marathon Bombing and the rise of the IS, interest in the 
program was renewed.^^ Former Attorney General Eric Holder announced in September 
2014 that CVE efforts would be focused on three cites, which were identified as Boston, 
Eos Angeles, and Minneapolis-St. Paul. The “Three City Pilot” effort tasked authorities 
in those cities with developing local CVE programs targeting IS-related radicalization.^o 
The three pilot cites were chosen by the federal government based on their “existing 
achievements with community engagement.’’^! A fourth program was developed in 
Montgomery County, Maryland, by a NGO in partnership with local government. 

A search for literature on the four models yields primary source information 
released by various stakeholder panels enacted by the local jurisdictions to create and 
implement the CVE models. For example, Boston and Eos Angeles both released 
documents, referred to as “frameworks,” outlining their plans for the creation and 
implementation of their CVE models. ^2 frameworks clearly describe the intended 


Lorenzo Vidino, Countering Radicalization in America (Washington, DC: United States Institute of 
Peace, 2010), 2, http://dspace.africaportal.Org/jspui/bitstream/123456789/31361/l/SP%20262-%20Counter 
ing%20%20Radicalization%20in%20America.pdf 

Lorenzo Vidino and Seamus Hughes, Countering Violent Extremism in America (Washington, DC: 
Center for Cyber and Homeland Security: The George Washington University, 2015), https://cchs.gwu.edu/ 
sites/cchs.gwu.edu/files/downloads/CVE%20in%20America%20.pdf 

“Pilot Programs Are Key to Our Countering Violent Extremism Efforts,” February 18, 2015, 
http://www.justice.gov/opa/blog/pilot-programs-are-key-our-countering-violent-extremism-efforts. 

51 Ibid. 

52 U.S. Attorney’s Office District of Massachusetts, A Framework for Prevention and Intervention 
Strategies: Boston CVE Framework (Boston: U.S. Attorney’s Office District of Massachusetts, 2015), 
http://www.justice.gOv/sites/default/files/usao-ma/pages/attachments/2015/02/18/framework.pdf; Los 
Angeles Interagency Coordination Group, Los Angeles Framework for CVE-Full Report (Los Angeles: Los 
Angeles Interagency Coordination Group, 2005), http://www.dhs.gov/sites/default/files/pubhcations/Los% 
20Angeles%20Framework%20for%20CVE-Full%20Report.pdf 
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parts of the models and identified their goals. Several fact sheets on the pilot cities’ CVE 
programs were issued by the federal government. The Minneapolis-St. Paul team did not 
issue a framework document, but a fact sheet does exist. ^3 Additionally, numerous 
articles from media sources are available on the pilot cities programs, but the majority of 
the information is taken from the releases provided by the programs themselves. The 
fourth program, located in Montgomery County, Maryland, and known as the 
Montgomery County Model (MCM), has also released information on its program, which 
identifies the parts and goals of the program. Recently, the MCM has expanded to other 
jurisdictions. As a result, the name of the program has changed to Building Resilience 
Against Violent Extremism (BRAVE). In the summer of 2016, BRAVE released a three- 
year strategic plan outlining recommendations and future growth.^"^ 

The MCM of CVE is the first community based and led CVE model in the 
country. The model was developed by the WORDE, which is a NGO. According to 
WORDE’s director. Dr. Hedieh Mirahmadi, the MCM was designed to be a community- 
led, public-private partnership rooted in interfaith collaboration.^^ WORDE has partnered 
with the Montgomery County Police (MCP) Department and the Montgomery County 
Executive’s Office of Community Partnerships. The MCM is tied to the Office of 
Community Partnerships’ Eaith Community Working Group (ECWG). The ECWG is 
composed of faith-based community leaders, the MCP, trauma-informed counselors, 
youth activists, and violence prevention experts. “The success of the program relies on a 
trusting relationship among local police, schools, health and human services agencies, 
and the faith community, whereby persons, who may be radicalized, regardless of the 


^3 United States Attorney’s Offiee, Minneapolis-St Paul Building Community Resilience Program- 
Pilot Fact Sheet (Minneapolis, MN: United States Attorney’s Offiee, 2015), http://www.dlis.gov/sites/ 
default/files/publieations/Minneapolis-St%20Paul%20Building%20Community%20Resilienee%20 
Program-Pilot%20Faet%20Sheet.pdf 

World Organization for Resource Development and Education (WORDE), The Building Resilience 
against Violent Extremism (BRAVE) Model—A Collective Impact Initiative That Increases Public Safety 
and Social Cohesion. 

George J. Selim et al., “New Strategies for Countering Homegrown Violent Extremism,” The 
Washington Institute for Near East Policy, November 21, 2013, http://www.washingtoninstitute.org/pobcy- 
analysis/view/new-strategies-for-countering-homegrown-violent-extremism. 
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reason, are identified as possibly benefitting from an intervention.”^^ The goal of the 
MCM is to edueate the public and governmental organizations on the risk factors 
associated with violent extremism, and then to refer the appropriate resources to 
intervene with the at-risk individuals before they progress down a path to radicalized 
violence. 

Studies on the different CVE models are being conducted by such institutions as 
the National Institute of Justice (NIJ) and the Police Executive Research Eorum (PERE), 
and one study of the Minneapolis/St. Paul model is being conducted by the Elniversity of 
Southern California.^s It is expected that the studies will provide additional information 
on the differences between the programs, and assist in identifying any strengths and 
weaknesses of the different programs. 

3, National Security Laws and Confidentiality 

Governments in democratic countries have an obligation to protect themselves, 
their citizens, and their interests. Eederal laws, such as the National Intelligence Act and 
the PATRIOT Act (and since 2015, its successor, the USA EREEDOM Act) spell out the 
U.S. government’s responsibility and authority.^9 The structure of these laws ensures that 
protective efforts remain balanced with the protection of civil liberties, “The governments 
of free societies charged with fighting a rising tide of terrorism are thus faced with a 
democratic dilemma: If they do not fight terrorism with the means available to them, they 
endanger their citizenry; if they do, they appear to endanger the very freedoms which 


Hedieh Mirahmadi, “An Innovative Approach to Countering Violent Extremism,” The Washington 
Institute for Near East Policy, October 9, 2013, http://www.washingtoninstitute.org/policy-analysis/view/ 
an-innovative-approach-to-countering-violent-extremisml. 

“The Montgomery County Model,” accessed July 27, 2015, http://www.dhs.gov/sites/default/fdes/ 
publications/Montgomery%20County%20MD%20Community%20Partnership%20Model-WORDE%20 
Report.pdf 

National Center of Excellence for Risk and Economic Analysis of Terrorism Events (CREATE), 
Foreign Fighters: Terrorist Recruitment and Countering Violent Extremism in Minneapolis-St. Paul (Los 
Angeles, CA: University of Southern California, 2015), http ://securitydebriefcom/wp-content/uploads/ 
2015/04/Foreign-Fighters-Terrorist-Recmitment-and-CVE-in-Minneapohs-St-Paul.pdf 

59 National Security Act of1947, 50 U.S.C. 401, 1947, https://www.ncsc.gov/training/resources/ 
nsaactl947.pdf; Lou Ann Wiedemann, “Homeland Security Act, Patriot Act, Freedom of Information Act, 
and HIM (2010 Update),” Journal ofAHIMA, November 2010, http://bok.ahima.org/doc?oid=106172. 
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they are eharged to proteet.”^*’ This balanee has sometimes been deseribed as a pendulum 
that swings toward seeurity in times of danger, and then baek towards eivil liberties and 
inereased freedom during times of peaee, “Thus it seems that the demoeraeies are 
destined to wander to and fro between the poles of too mueh liberty and too extensive a 
security effort, walking the fine line between security and freedom. ”^1 An argument can 
be made that freedom is not possible under threatening conditions. A counter argument 
may be made that freedom trumps all. Balancing and ensuring both is the responsibility 
of the government and the people. Free speech, a free press, courts, and elections are all 
part of the balancing process. Laws, and granting power to government agencies, provide 
the counterbalance. 

After WWII, and at the beginning of the Cold War, the U.S. government enacted 
the National Security Act, which called for a major re-organization of the military and 
intelligence community.^^ Act defines intelligence as all information that involves 
threats to the country, its citizens, property, or interests. Intelligence is also defined as 
anything having to do with the proliferation of weapons of mass destruction, or any other 
matter affecting U.S. national or homeland security. The use of the term homeland 
security seems like a newer phenomenon, but it was actually used in this sweeping 
legislation in 1947. The National Security Act begins to define authority and 
responsibility in reference to intelligence issues. Executive Orders (EOs) are legal entities 
that describe how other laws will be applied to various entities within the government. 

In addition to the major re-structuring of government, and the creation of the 
Central Intelligence Agency, the National Security Act laid the groundwork for the 
government’s framework for providing today’s national security efforts and a base upon 
which future laws would be built. EO 12333, issued by President Ronald Reagan, is good 


Benjamin Netanyahu, Fighting Terrorism: How Democracies Can Defeat Domestic and 
International Terrorism, 2001st ed. (New York: Farrar, Straus, and Giroux, 1995), 67. 

Netanyahu, Fighting Terrorism: How Democracies Can Defeat Domestic and International 
Terrorism, 99. 

^2 “Truman Signs the National Seeurity Aet-Jul 26, 1947,” aeeessed August 14, 2016, http://www. 
history.eom/this-day-in-history/tmman-signs-the-national-seeurity-aet. 
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63 

example of a legal aetion building upon the National Seeurity Aet. The EO defines and 
relegates the duty of eivilian intelligenee and eounter-intelligenee responsibilities in the 
homeland to the FBI. The EO also affirms the government’s right to eolleet and use 
intelligenee on El.S. persons, and mandates that the methods be the least intrusive as 
possible. It also delegates the oversight proeess to various entities within the government. 

In short, the National Seeurity Aet and the EO, whieh elarifies roles and methods, 
provides the U.S. government with the authority to proteet the eountry, its eitizens, and 
interests by eolleeting and using intelligenee. A separation of powers was developed in 
whieh normal intelligenee ageneies are aimed outside of the United States, and the FBI is 
relegated with the authority as a eivilian EE ageney to eonduet proteetive investigations 
on U.S. soil, although the reaeh of the FBI extends oversees. 

The PATRIOT Aet is another example of sweeping legislation in response to a 
major national seeurity event.®"^ The Aet was the largest re-organization of this nation’s 
federal government sinee the National Seeurity Aet. The expedited ereation of the Aet 
and the seope of its ehange are both notable. In addition to a large seale re-organization 
and the ereation of the DHS, it is also important to reeognize that the Aet is aimed 
direetly at terrorism targeting the U.S. homeland. As a result, the Aet both foeuses and 
inereases the government’s ability to eolleet, use, and store intelligenee. 

Some of the authority vested in the government by the Aet has ereated 
eontroversy. Some of this eontroversy has bled over into the realm of CVE. Speoifieally, 
Seetion 215 of the Patriot Aet has reeeived a signifieant amount of oritieism for the broad 
power it granted the government in eolleeting data on U.S. eitizens.Mueh of the debate 
has surrounded the ability the seetion granted the National Seeurity Ageney to monitor 
and eolleet eleetronie data. The publie response to this aspeet of the Aet has been used by 
some to fuel diseontent in other areas. 

“Executive Order 12333—United States Intelligence Activities,” accessed August 15, 2016, http:// 
www.archives.gov/federal-register/codification/executive-order/12333.html. 

“What Is the USA Patriot Act: Preserving Life and Liberty,” accessed August 20, 2016, https:// 
www.justice.gov/archive/ll/highlights.htm. 

“Law Enforcement & National Security Access to Medical Records,” July 11, 2013, https://cdt.org/ 
insight/law-enforcement-national-security-access-to-medical-records/. 
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Some of the literature used for this thesis eonnects the government’s colleetion of 
data to eonfidentiai personal information in the field of psyehotherapy.^^ Aeeording to a 
2004 artiele from The Therapist, eoneern has arisen within the field of psyehotherapy that 
the PATRIOT Act, in particular Section 215, grants the government carte blanche to 
collect personal health information (PHI). Expressly, claims have been made that the 
section allows the FBI to require therapists to turn over “books, records, papers, 
documents, and other items,” while at the same time, prohibiting the therapist from 
advising the patient that the government was seeking or obtaining the information.^^ 
These claims are technically true, but not at all a new development. The FBI and other 
FE agencies have always been able to collect information as part of criminal 
investigations. 

The law has always had checks and balances and provided oversight for the 
process. Investigators must possess a certain level of proof (probable cause), articulate 
the proof in a sworn document (search warrant), and receive approval from a judge 
(oversight) to seize information (or anything else of an evidentiary nature). None of these 
legal requirements are new, expanded, or out of the ordinary. It should also be noted that 
the Act does not require mandatory notification of the government by therapists, or 
anyone else. 

One point of possible concern is Section 215, and the collection of information. 
Section 215 makes changes to the Foreign Intelligence Surveillance Act (FISA), which 
allows for the FBI director, or designee, to apply for a court order to seize PHI through 
the Foreign Intelligence Court (FISC).^^ While the FISC provides the same oversight 
over 4th Amendment search and seizure issues as regular courts and magistrates, it adds a 
layer of secrecy to the proceedings. The secret nature of the FISC was necessary due to 
the court’s original purpose as an oversight of foreign intelligence investigations. The 
court serves as a balance of oversight and secrecy to protect the integrity of counter- 

Benitez, “Confidentiality and Its Exceptions (Including the U.S. Patriot Act),” 32-36. 

“FAQ on Government Access to Medical Records,” accessed August 15, 2016, https://www. 
aclu.org/faq-govemment-access-medical-records. 

“Law Enforcement & National Security Access to Medical Records.” 
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intelligence investigations. The expansion of the use of the FISC for counter-terrorism 
investigations serves the same purposes. While the oversight remains the same, it is more 
difficult to shine the light of public oversight to FISC proceedings. “As the law stands 
now, the federal government has multiple avenues for accessing medical records by 
citing national security considerations, and gag provisions in the Patriot Act make it 
difficult to know how this power is being used.”^^ 

The bottom line is that Section 215 of the Patriot Act expands the use of the FISC 
to include investigations of domestic terrorism, The use of the court retains the same 
level of judicial oversight (perhaps more) as other judicial venues used by government 
investigators to have search and seizure warrants issued. Additionally, the nature of the 
system has not changed in reference to the ability for the federal government to use 
Section 215 for a “fishing expedition.”^! The opportunity does not exist. If a CVE 
practitioner is served with a search and seizure warrant or court order ordering the release 
of PHI, it is in relation to an investigation of a serious national threat. If the CVE 
practitioner has not provided the government with the information that was used to open 
the investigation, and the government developed probable cause from sources not related 
to the CVE practitioner, the practitioner has no choice but to comply with the warrant. 

4, Multi-Disciplinary Teams 

Eor many years, different fields have relied on multidisciplinary efforts to find the 
best approach to shared goals. MDTs are typically composed of a group of professionals 
from different fields who share a common purpose, but contribute different areas of 
expertise to the effort.^^ gy definition, CVE efforts are already a form of MDT. This 
thesis studies the expansion of the use of the MDT model to improve cooperation and 
communication with an increased set of practitioners involved in CVE. Since MDTs have 
existed for several decades and been used in multiple fields, sufficient information exists 

“National Security and Medical Information.” 

“Law Enforcement & National Security Access to Medical Records.” 

“FAQ on Government Access to Medical Records.” 

^2 The Free Dictionary, s.v. “Multidisciplinary Team,” accessed July 11, 2016, http://medical- 
dictionary.thefreedictionary.com/multidisciplinary+team. 
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on their history and use. MDTs have previously been sueeessfully used to address 
eomplex issues. Some of the areas where MDTs have been applied (such as child abuse 
investigations) involve many of the same professionals involved in CVE intervention 
programs. ^3 As a result, the focus is on the use of MDT in response to reports of child 
abuse with comparisons made to the adoption of the use to CVE in an expanded capacity. 

The EBI has suggested its own version of an MDT in the form of shared 
responsibility committees (SCRs).^"^ The federal government has been vague in the 
information released concerning SRCs; however, the public response from certain areas 
has been swift and strong. Eew official sources are available that document the 
government’s intent or use of SRCs, while ample secondary sources exist criticizing the 
proposed program. ^5 Research for this thesis provides an analysis of what is known about 
the SRCs, a comparison to other MDT processes, and a recommendation on how to move 
forward. 


5. Summary 

The threat to the United States represented by HVEs is constantly evolving partly 
because of the pace of changes in other parts of the world. Eor example, IS currently is 
considered one of the greatest terror threats, yet did not exist just several years ago. As 
conditions around the world change and evolve, the threat in the U.S. homeland continues 
to transform. The fast pace at which technology progresses affects how terror groups 
plan, recruit, communicate, and attack. 

In response, efforts to counter violent extremism may be advancing faster than 
studies and research on the policies and programs can be completed. The use of CVE in 
the United States has been researched for several years, but models of the program have 
only begun to be implemented as of 2016. Studies of the models have recently been 


^^“Multidisciplinary Team,” accessed July 8, 2016, http://www.nationalcac.org/about/multi-team.html. 

34 Murtaza Hussain and Jenna McLaughlin, “FBI’s ‘Shared Responsibility Committees’ to Identify 
‘Radicalized’ Muslims Raise Alarms,” The Intercept, April 9, 2016, https://theintercept.eom/2016/04/ 
09/fbis-shared-responsibility-committees-to-identify-radicalized-muslims-raises-alarms/. 

35 Julian Hattem, “Key Dem Wants Watchdog to Probe Little-known FBI Program,” The Hill, April 
29, 2016, http://thehill.com/pohcy/national-security/278223-key-dem-wants-watchdog-to-probe-fbi. 
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conducted by such groups as the NIJ and PERF. Researeh on foreign programs is 
abundant, but is not the foeus of this thesis beeause U.S. laws are different and unique 
from other eountries. 

Suffieient information exists to analyze CVE models, intervention or diversion, 
and to conduet a legal analysis of the laws that affeet the topies of confidentiality, duty to 
warn, and the notifieation of the proper authorities by CVE practitioners when they 
determine a threat or possible threat exists. 

E. RESEARCH DESIGN 

The thesis analyzed the two major legal areas that affeet CVE intervention, 
diversion, and defieetion (medical record confidentiality and the duty to warn or proteet) 
and how they faeilitate or restrict practitioners from making notification to authorities 
eoneerning elients who remain or beeome a threat. This portion of the thesis takes the 
form of a legal analysis that determines the meaning of the eases and their respeetive 
implieations. 

The goal of the thesis is to define and explain the spaee in whieh diversion and 
intervention praetitioners must operate in terms of the ability and requirements related to 
their duty to warn, eonfidentiality, and national seeurity exeeptions. The output from the 
thesis is a set of struetural reeommendations to faeilitate intervention efforts by 
integrating or leveraging organizational models already in use. 

CVE practitioners will need to be knowledgeable in medieal eonfidentiality laws 
at both the federal and state levels to eomply and understand exeeptions to the laws. 
HIPAA’s Privaey Rule is analyzed, and Maryland law stands in for state law. Most 
mental health providers are familiar with the theory of duty to warn. This paper explores 
the cause for state duty to warn laws and apply the legal theory, and speoifieally 
Maryland’s laws, to CVE related intervention programs. Sinee CVE programs are a 
eollaboration of praetitioners from various fields, it is useful for all involved to 
understand the way that medical confidentiality and duty to warn laws impaet the 
operations of CVE intervention programs. The paper then suggests models for 
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collaboration that may be applied to CVE programs as a whole, and work groups 
eonsisting of members from different disciplines. 
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II. MEDICAL RECORDS AND THE THEORY OF 
CONFIDENTIALITY 

A, FEDERAL PRIVACY FRAMEWORK 

The theory of confidentiality in health care may be traced to the Hippocratic Oath, 
which states, “What I may see or hear in the course of the treatment or even outside of 
the treatment in regard to the life of men, which on no account one must spread abroad, I 
will keep to myself, holding such things shameful to be spoken about.”^^ For health care 
practitioners, confidentiality is both an ethical and a legal issue. Confidentiality is 
essential for the treatment of both physical and mental health issues, but as Benitez 
reminds us, “Confidentiality is defined as a restriction on the volunteering of information 
outside of the courtroom setting, not to be confused with the concept of psychotherapist- 
patient privilege.Privilege is a legal concept that involves special relationships 
between such practitioners as lawyers and medical professionals and their clients. 
Privilege has to do with the right of the client to withhold testimony in court by the 
individual with whom they hold the relationship.^^ According to her article in The 
Therapist titled, “Confidentiality and it Exceptions (Including the U.S. Patriot Act),” 
Benitez explains the difference between confidentiality and privilege; 

These terms are not synonymous. They apply in different circumstances 
and are addressed in separate sections of law. The psychotherapist patient 
privilege affords the holder of the privilege (usually the patient) the right 
to withhold testimony (your testimony) in a court of law. The 
psychotherapist-patient privilege arises from the special relationship 
therapists have with their patients. It is an exception to the general rule 
that requires testimony from witnesses who are subpoenaed to provide 
such testimony. 


Ask a Librarian, “Guides: Bioethics: Hippocratic Oath,” Johns Hopkins University, accessed July 
13, 2016, http://guides.library.jhu.edu/c.php?g=202502&p=1335752. 

Benitez, “Confidentiality and Its Exceptions (Including the U.S. Patriot Act),” 1. 
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According to one expert, “Without assurances of confidentiality, patients will be 
reluctant to divulge sensitive information about their physieal and mental health, 
behavior, and lifestyle that would be vital to the individual’s treatmentf’^o During 
testimony before the Congressional Subcommittee on Investigations and Oversight, 
House Committee on Energy and Commeree, Professor Mark Rothstein of the University 
Of Louisville School Of Medicine spoke of the importanee of confidentiality of medical 
records by stating: 

The Privacy Rule eodifies this crucial requirement for ethieal and effective 
health care. Surveys of patients indieate that many of them, fearful of 
diselosure of their sensitive health information, eurrently engage in 
“defensive practiees” by withholding certain information from their health 
care providers. Any weakening of privaey proteetions would undoubtedly 
increase the use of defensive practices. 

In his testimony, Rothstein cited a survey eonducted by the California Healtheare 
Foundation in whieh two thirds of the publie surveyed expressed eoneem over the 
privacy and security of their health information. ^2 

To ensure the protection of sensitive and private health information, the federal 
government and states have passed legislation defining the legalities. The laws define the 
circumstances in whieh a practitioner may or must disclose confidential information. This 
ehapter analyzes the laws, explains the cireumstances, and applies the laws to mental 
health practitioners working in the realm of CVE. 

Federal laws tend to be broad and far-reaehing forms of legislation that in many 
oases define what is allowable at the state and local levels of government. Many federal 
regulatory laws may be viewed as defining the “bare minimum,” whieh then opens the 
door for state law to impose stricter requirements. As a result, state laws are frequently 


Mark A. Rothstein, Testimony of Mark A. Rothstein Subcommittee on Investigations and Oversight, 
House Committee on Energy and Commerce (Washington, DC: U.S. Congress, 2013), 1-2, http://does. 
house.gOv/meetings/IF/IF02/20130426/100769/HHRG-l 13-IF02-Wstate-RothsteinM-20130426.pdf. 

81 Ibid. 

82 “Consumers and Health Information Teehnology: A National Survey,” April 2010, 2, http://www. 
eheforg/~/media/MEDIA%20LIBRARY%20Files/PDF/PDF%20C/PDF%20ConsumersHealthInfoTeehnol 
ogyNationalSurvey.pdf 
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more restrictive than federal laws covering the same topic. negative consequence 
of the existence of different laws affecting the same topic, but created by different levels 
of government, is the legal confusion they may create. While this combination of laws 
affords some practitioners and patients a great deal of confidentiality protection, it also 
makes for confusion, as standards and strictures change from jurisdiction to jurisdiction. 
When referring to confidentiality law, most practitioners refer to HIPAA. Rarely are state 
laws spoken of or cited. When state laws afford exceptions, they must also align with the 
federal law. For example, Maryland law allows for the sharing of confidential medical 
information with any state sanctioned representative conducting their official business. 
This exception must then also align with the Privacy Act exceptions. 

1. HIPAA Background 

The Health Insurance Portability and Accountability Act, commonly known as 
HIPAA, is the federal law of the land regulating health care information. As a result, 
HIPAA, and the accompanying Privacy Rule, represent the bare minimum of legal 
regulation of PHI. Due to the confusion surrounding the implications of the law, HIPAA 
has been described as the elephant in the room that may need to be euthanized (or at least 
better defined and explained to the public and practitioners).The application of the 
federal law has created a confusing environment in which health care providers must 
learn to operate. The impact of the law is so confusing that both government and private 
companies frequently bring in outside experts to conduct training for employees. Even 
with specialized training, a lot of confusion remains concerning who the law applies to, 
and what the law requires or allows. It has been asserted that medical entities regulated 
by federal law may use the existence of the law as an excuse not to make lawful 


^3 John Petrila and Hallie Fador-Towe, Information Sharing in Criminal Justice—Mental Health 
Collaborations: Working with HIPAA and Other Privacy Laws (Lexington, KY: CSG Justice Center, 

2010), vii, https://csgjusticecenter.org/wp-content/uploads/2012/12/Information_Sharing_in_Criminal_ 
Justice-Mental_Health_Collaborations-2.pdf 

State of Maryland, 22. Medical Records Act—Duty to Hold Confidential and Duty to Disclose a 
Medical Record, Health-General Article § § 4-301—4-309, S-(507(Baltimore, MD: Maryland Department of 
Mental Health and Hygiene, n.d.), accessed September 12, 2016, http://dhmh.maryland.gov/psych/pdfs/ 
Medicalreports.pdf 
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disclosures of medical information in situations that may warrant the disclosure. The lack 
of disclosure may be the result of ignorance of what laws dictate, allow, or mandate; or 
the laws may actually be used as an excuse not to disclose if the disclosure is deemed 
inconvenient or burdensome. 

As with all legislation, HIPAA began as a bill, proposed by U.S. Senators Edward 
Kennedy and Nancy Kassebaum to address privacy and confidentiality with health care 
information. Prior to the proposal of the bill, no federal law regulated the confidentiality 
of PHI.The bill was passed by Congress and signed by President Bill Clinton on 
August 21, 1996. The new federal law (HIPAA) was also known as Pub. L. No. 104- 
191.88 Even though the original intent of the bill, and subsequent law, was to regulate the 
electronic transfer of private medical information, and to mandate privacy regulations on 
certain covered entities, HIPAA and the Privacy Rule have “become the de facto legal 
standard for health privacy issues involving both covered and un-covered entities in the 
United States.”89 

Title 45 of the Code of Eederal Regulations (CER) provides the regulations and 
rules that apply to the Department of Health and Human Services (DHHS). Section 160. 
103 provides the federal definition of health care as: 

care, the services and supplies related to an individual’s health, are all 
considered health care. Preventative, diagnostic, rehabilitative, 
maintenance, or palliative care, counseling service, assessment, or 
procedure with respect to the physical or mental condition or functional 


8^ Rothstein, Testimony of Mark A. Rothstein Subcommittee on Investigations and Oversight, House 
Committee on Energy and Commerce, 4. 

87 Daniel J. Solove, “HIPAA Turns 10: Analyzing the Past, Present and Future Impact,” Journal of 
AHIMA 84, no. 4 (April 2013): 22-28. 

88 Rebecca Herold and Kevin Beaver, The Practical Guide to HIPAA Privacy and Security 
Compliance, 2nd ed. (United Kingdom: Taylor & Francis Group, LLC, 2015), 1. 

89 Mark A. Rothstein, “Tarasoff Duties after Newtown,” Journal of Law, Medicine & Ethics 42 
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status of an individual or that affects the structure or function of the 

body.90 

HIPAA defines regulated health information as, “[ijindividually identifiable 
health information transmitted by electronic media, maintained in electronic media, 
transmitted or maintained in any other form or medium. ”91 HIPAA uses this definition to 
identify what is referred to as PHI under the law. PHI may also be described as any 
information related to health care that may individually identify the patient, such as any 
data that relates to an individual’s past, present, or future physical or mental health, 
payment, or provision of care to the individual.^^ pjjj covered by HIPAA includes: 

• Patient names 

• Geographic areas smaller than a state to include street addresses, city or 
town, county, precinct, or zip code 

• Numerical identifiers, such as telephone numbers, social security numbers, 
medical record numbers, health plan beneficiary numbers, account 
numbers, certificate/license numbers, device identifiers and serial 
numbers, and elements of dates related to birth, death, admission or 
discharge, except for the year 

• Email addresses 

• Vehicle identifiers 

• Computer identifiers, such as uniform resource locators and internet 

provider addresses 

• Images and photographs 

• Biometric identifiers, such as DNA, fingerprints, and voice prints 

• Any other identifying factor unique to the patients 


Cornell University Law, LII/Legal Information Institute, “45 CFR 160.103—Definitions,” accessed 
July 23, 2016, https://www.law.comell.edu/cfr/text/45/160.103; U.S. Government, 45 CFR Part 160 — 
Subchapter C—Administrative Data Standards and Related Requirements (Washington, DC: Government 
Printing Office, n.d.), 698, accessed August 6, 2016, https://www.gpo.gov/fdsys/pkg/CFR-2007-title45- 
voll/pdf/CFR-2007-title45-voll-partl60.pdf 

Herold and Beaver, The Practical Guide to HIPAA Privacy and Security Compliance, 16. 

“Summary of the HIPAA Privacy Rule,” May 7, 2008, http://www.hhs.gov/hipaa/for-professionals/ 
privacy/laws-regulations/index.html. 

Herold and Beaver, The Practical Guide to HIPAA Privacy and Security Compliance, 16. 
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HIPAA delegated the DHHS as the arm of the federal government responsible for 
implementing and enforeing HIPAA and the standards inherent in the law.^^ The original 
language of the law, loeated in Seetions 261-264, assigned responsibility to the Seeretary 
of DHHS to make publie the standards and practiees for the exehange and proteetion of 
PHI. 


Furthermore, the law required that the Seeretary of DHHS issue the regulations 
mandating the aeeomplishment of the law if Congress failed to do so within three years 
after the law was passed. DHHS released a proposed set of standards to the publie for 
eomment in November 1999. In 2002, DHHS released the Standards for Privaey of 
Individual Identifiable Health Information, whieh is eommonly referred to as the Privaey 
Rule. 95 DHHS also assigned oversight and enforeement responsibilities to its Offiee for 
Civil Rights (OCR).96 

2. The Privacy Rule 

The Privaey Rule ereates the national standards for the protection of PHI. The 
main goal of the Privacy Rule is to balance the confidentiality of an individual’s PHI with 
society’s needs. When crafting the Privacy Rule, DHHS recognized that the disclosure or 
sharing of otherwise protected PHI was sometimes necessary to accomplish public health 
goals and other community needs. 

Public health practice often requires the acquisition, use, and exchange of 
PHI to perform public health activities (e.g., public health surveillance, 
program evaluation, terrorism preparedness, outbreak investigations, 
direct health services, and public health research). Such information 
enables public health authorities to implement mandated activities (e.g., 
identifying, monitoring, and responding to death, disease, and disability 
among populations) and accomplish health objectives.9^ 


94 Herold and Beaver, The Practical Guide to HIPAA Privacy and Security Compliance, 6. 

95 “Summary of the HIPAA Privacy Rule.” 

96 Ibid. 

97 “HIPAA Privacy Rule and Public Health, Guidance from CDC and the U.S. Department of Health 
and Human Services*,” April 11, 2003, http://www.cdc.gov/mmwr/preview/mmwrhtml/m2e41 lal.htm. 
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The Privacy Rule applies its regulations to organizations it refers to as covered 
entities, “health plans, health care clearing houses, and any health care provider who 
transmits any health care information electronically.”98 Due to the sometimes ambiguous 
nature of laws and the manner in which they are written, whether an agency, or an 
individual, qualifies as a covered entity remains vague. Many practitioners have taken the 
stance that they are covered entities and conduct their business within the guidelines of 
the Privacy Rule. According to a report sponsored by the federal Bureau of Justice 
Assistance titled. Information Sharing in Criminal Justice-Mental Health Collaborations: 
Working with HIPAA and Other Privacy Laws, “HIPAA’s restrictions on sharing health 
information are often misunderstood, which has resulted in practitioners’ misapplying the 
law to be far more restrictive than the actual regulatory language requires.”99 

In general, the Privacy Rule provides for the following areas: 

• Gives patients increased control over their own health information 

• Describes the confines related to the use, maintenance, and disclosure of 

health records 

• Sets protective measures that most health-care providers must follow to 
protect the confidentiality of PHI 

• Enforces violations of the Privacy Rule with civil and criminal penalties 
which are enforced by the DHHSOCR 

• Balances individual privacy with the good of the public 

• Allows patients to make decisions on how their own PHI may be used 

• Allows patients the opportunity to learn if a covered entity has disclosed 
their PHI 

• Limits PHI disclosure to the amount minimally reasonable to accomplish 
the purpose of the disclosure 

• In most cases, allows the patient the right to have copies of their own 
medical records and the ability to request corrections 


98 “Summary of the HIPAA Privacy Rule.” 

99 Petrila and Fador-Towe, Information Sharing in Criminal Justice—Mental Health Collaborations: 
Working with HIPAA and Other Privacy Laws, viii. 
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• Allows individuals to control the use and diselosure of their PHpoo 

When deeiphering the meaning inherent in the Privacy Rule, one of the first steps 
involves determining who is a eovered entity, or who is regulated by the Rule. At first 
look, it seems that the entities eovered are any health plan, health eare elearing house, or 
any health eare provider who transmits PHI eleotronieally.ioi As noted previously, both 
behavioral and physieal health eare providers are eovered entities. The law does not 
differentiate between organizations that provide general eare and speeialty health eare 
providers or faeilities. Correetional faeility health eare is covered. 1*^2 

As important as determining who or what may be eovered is determining who or 
what is not eovered. LE ageneies and offieers are not eovered entities. “The HIPAA 
Privaey Rule broadly defines law enforeement as ‘any government offieial at any level of 
government authorized to either investigate or prosecute a violation of the law.”i03 As a 
result, LE is not bound by the regulations when asked to provide PHI to others, unless the 
LE offieer originally gained the information from another entity eovered by the 
regulations. 104 For example, if a LE official obtains PHI as the result of an exeeption, the 
PHI may not be further shared unless the subsequent reeipient also falls under an 
exeeption. Courts and judieial systems are also not eovered by HIPAA or the Privaey 
Rule due to the responsibility they hold in senteneing or monitoring the treatment of 
persons in the system. This exelusion also takes into aeeount the eourt’s role in 
overseeing treatment and eomplianee with its rulings. 105 “Correctional institutions are not 
eonsidered ‘eovered entities’ under HIPAA unless they elassify themselves as sueh.”i06 


100 “HIPAA Privacy Rule and Public Health, Guidance from CDC and the U.S. Department of Health 
and Human Services*.” 

101 Herold and Beaver, The Practical Guide to HIPAA Privacy and Security Compliance, 12. 

102 Petrila and Fador-Towe, Information Sharing in Criminal Justice—Mental Health Collaborations: 
Working with HIPAA and Other Privacy Laws, 11. 

103 “Law Enforcement Access,” accessed August 15, 2016, https://www.eff org/issues/law- 
enforcement-access. 

104 pgp-iH and Fador-Towe, Information Sharing in Criminal Justice—Mental Health Collaborations: 
Working with HIPAA and Other Privacy Laws, 5. 

105 Ibid., 8-10. 

106 Ibid., 11. 
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These instances may be an example of the institution applying the boundaries of the law 
in an over-reaching manner due to a lack of understanding of the law, or because it is 
easier to be classified as a covered entity and then not have to face civil liability for 
releasing PHI even if the disclosure is allowable under the language of the law. 

The Privacy Rule also identifies what it describes as hybrid entities; covered 
entities that perform functions that are both covered and not covered.!*’^ A hybrid entity 
may separate its functions so that the Privacy Rule only applies to those functions that 
align with covered entities. The remaining functions would not fall under the regulation 
of the Rule. 108 xhe onus for determining which components are covered falls upon the 
entity. The portions of the hybrid entity must then function as standalone covered entities 
and must treat the non-covered components as it would outside business associates in 
terms of abiding to the Privacy Rule.i09 

The Privacy Rule mandates some affirmative duties on covered entities. These 
duties represent standards that must be adopted by any covered entity. The Privacy Rule 
requires that covered entities: no 

• Notify individuals of their privacy rights as afforded by the Privacy Act, 
and of how any of their PHI may be used or disclosed 

• Create and implement internal policies and procedures for the safekeeping 
of PHI (including physical security procedures) 

• Train employees on the policies and procedures 

• Assign employees to manage the enactment of privacy policies and who 
will handle related complaints 

• Include appropriate privacy regulations in contracts with business partners 

• Entities must accommodate clients’ rights 

11*^ U.S. Government, 45 CFR Part 164 Subpart A — General Provisions (Washington, DC: 
Government Printing Office, n.d.), accessed August 6, 2016, https://www.gpo.gov/fdsys/pkg/CFR-2007- 
title45-voll/pdf/CFR-2007-title45-voll-parti 64-subpartA.pdf 

108 “HIPAA Privacy Rule and Public Health, Guidance from CDC and the U.S. Department of Health 
and Human Services*.” 

1^9 U.S. Government, 45 CFR Part 164 Subpart A — General Provisions, 733. 

110 “HIPAA Privacy Rule and Public Health, Guidance from CDC and the U.S. Department of Health 
and Human Services*.” 
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The Privacy Rule defines the term disclosure as, “the release, transfer, provision 
of, access to or divulging in any other manner of information outside the entity holding 
the information.”! 11 The Privacy Rule mandates the disclosure of PHI in only two 
circumstances, to the individual owner of the PHI (patient), and when required by the 
Secretary of DHHS when the agency needs to determine if a covered entity is complying 
with the regulations set forth in the Rule.n^ 

The Privacy Rule also delineates when it is may be permissible for a covered 
entity to disclose PHI. It is important to note that these exceptions are not required, but 
that the Rule allows for the disclosures under certain situations. The most obvious and 
broad exception is the use of consent by the owner of the PHI to disclose or use the 
information. When the use of the PHI is not for the purposes of treatment, billing, or 
otherwise permitted by the Privacy Rule, a covered entity must obtain written permission 
from the individuals to disclose their PHI.n^ This option may apply in cases where the 
individual is referred to the covered entity by a court, such as community supervision or 
when the court allows a supervising agent, such as a parole or probation agent, the ability 
to obtain medical records to ensure compliance with a court mandate for the individual. 
Courts may make a condition of an individual’s release from custody or a treatment order 
that the individual grant consent for providers to release the individual’s PHI to ensure 
compliance, ii^i 

It is also acceptable for covered entities to disclose de-identified PHI. The Rule 
does not place any restrictions on the use of, or disclosure of de-identified PHI. The Rule 
clearly defines de-identified PHI as “aggregate statistical data or data stripped of 


111 U.S. Government, 45 CFR Part 160—Subchapter C—Administrative Data Standards and Related 
Requirements, 691. 

11^ U.S. Government, 45 CFR Part 164 Subpart E—Privacy of Individually Identifiable Health 
Information (Washington, DC: Government Printing Office, n.d.), 746, accessed August 6, 2016, https:// 
www.gpo.gOv/fdsys/pkg/CFR-2007-title45-voll/pdf/CFR-2007-title45-voll-parti 64-subpartE.pdf 

113 “Summary of the FlIPAA Privacy Rule.” 

11^ Petrila and Fador-Towe, Information Sharing in Criminal Justice—Mental Health Collaborations: 
Working with HIPAA and Other Privacy Laws, 8. 
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individual identiliers.”ii5 Title 45 CFR Part 164 Subpart E §164. 514 defines the process 
for creating de-identified PHI and provides a list of identifiers that must be removed from 
PHI to qualify as de-identified.The process of de-identifying PHI to remove the 
protections on the information provided by the Privacy Rule may be referred to as a “Safe 
Harbor” method. The process requires the removal of 18 identifiers from the PHI. The 
identifiers include information, such as names, numerical identifiers, images, and 
biometric information.The remaining information must not be capable of being used 
to identify the subject. 

Federal Title 45 CFR Part 164 Subpart E §164. 512 is titled “Uses and disclosures 
for which an authorization or opportunity to agree or object is not required.”ii9 As the 
title indicates, this section of the Privacy rule allows for the disclosure of PHI without the 
owner’s consent. 120 xhe Rule allows for the disclosure of PHI under certain conditions, 
but the Rule does not mandate or require the disclosure. The disclosure may, however, be 
mandatory under other law, such as state laws (see exception [a] or [c]). The exceptions 
listed in the section include: 121 

a) Uses and disclosures required by law 

b) Standard uses and disclosures for public health activities 

c) Disclosures concerning the victims of abuse, neglect, or domestic violence 

d) Disclosures for health oversight activities 

e) Disclosures for judicial and administrative proceedings 

f) Disclosures for law enforcement purposes 

g) Uses and disclosures in relation to medical examiners and coroners 

115 “HIPAA Privacy Rule and Public Health, Guidance from CDC and the U.S. Department of Health 
and Human Services*.” 

1U.S. Government, 45 CFR Part 164 Subpart E—Privacy of Individually Identifiable Health 
Information, 766-770. 

117 “HIPAA Privacy Rule and Public Health, Guidance from CDC and the U.S. Department of Health 
and Human Services*.” 

118 Ibid. 

1 m U.S. Government, 45 CFR Part 164 Subpart E—Privacy of Individually Identifiable Health 
Information, 757-766. 

120 Ibid. 

121 Ibid. 
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h) Cadaveric organ, eye, or tissue donation 

i) Research purposes 

j) Disclosures to avert serious threats to health and safety 

k) Specialized government functions 

The aforementioned letters also correspond with the paragraph sections in the Rule. This 
section focuses on paragraphs (j) and (k). 

§164. 512 paragraph (j) provides perhaps some of the most applicable guidance 
when considering the Privacy Rule in connection with the relationship between mental 
health practitioners and LE. The section reads as follows: 

(j) Standard: Uses and disclosures to avert a serious threat to health or 
safety- 


(1) Permitted disclosures. A covered entity may, consistent with 
applicable law and standards to ethical conduct, use or disclose 
protected health information, if the covered entity, in good faith, 
believes the disclosure: 

(0 


(A) Is necessary to prevent or lessen a serious and 
imminent threat to the health and safety of a person or the 
public; and 

(B) Is to a person or persons reasonably able to prevent or 
lessen the threat, including the target of the threat; or 

(ii) Is necessary for law enforcement authorities to identify or 
apprehend an individual 

(A) Because of a statement by an individual admitting 
participation in a violent crime that the covered entity 
reasonably believes may have caused serious physical harm 

to the victim. 122 

The section goes on to state that the use and disclosure of the PHI referenced in (j) 
(I) (ii) (A) is not permitted if the information is discovered by the covered entity during 
treatment in which the covered entity is determining the likelihood for the individual to 


122 U.S. Government, 45 CFR Part 164 Subpart E—Privacy of Individually Identifiable Health 
Information, 764. 
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commit the crime, or during counseling or therapy, or if the information is in relation to 
the reason for which the individual sought the treatment. In other words, if the covered 
entity is a therapist and is attempting to determine the likelihood of their patient 
committing a crime, the situation would not satisfy the exception. The section would also 
not be applicable if the propensity for the individual to commit the crime was the reason 
that the individual sought treatment. 

More broadly, paragraph (k), which addresses specialized government functions, 
focuses specifically on a national security exception to the Privacy Rule. Section (2) of 
the paragraph reads: 

National security and intelligence activities. A covered entity may disclose 
protected health information to authorized federal officials for the conduct 
of lawful intelligence, counter-intelligence, and other national security 
activities authorized by the National Security Act (50 U.S. C. 401, et seq. ) 
and implementing authority (e. g. Executive Order 12333). ^23 

Once again, it is important to note that even these “national security disclosures 
are permissive rather than mandatory under HIPAA (your doctor can say no), but the 
language—particularly the disclosures to agencies—is amazingly broad.”i24 

B, MARYLAND HEALTH CARE LAWS 

Since each state has its own companion laws to the federal medical privacy law, 
this thesis uses Maryland’s health care laws as the example of state law. Maryland’s 
health care laws are similar to HIPAA and the Privacy Rule. For example, Maryland’s 
law allows for the disclosure of PHI under certain circumstances, which are similar to the 
Privacy Rule exceptions. Like the federal exceptions, the disclosures under these 
circumstances are permissible and not mandatory. 

Maryland law relating to health records may be found in the State Code Article 
titled Health-General under sections §4-301 through §4-309. Section §4-301 provides 
definitions, including that the statute applies to both physical and mental health care 

123 U.S. Government, 45 CFR Part 164 Subpart E—Privacy of Individually Identifiable Health 
Information, 765. 

124 “National Security and Medical Information.” 
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providers. The statue also defines health eare providers as anyone lieensed, eertified, or 
authorized by the state to perform their duties. The seetion also defines medieal reeords 
to inelude “any oral, written, or other transmission in any form or medium of 
information” that may be entered into a patient’s file, identifies the patient, and relates to 
the eare of the patient. 

Seetion §4-302 has to do with eonfidentiality and the general diselosure of 
medieal reeords. The seetion mandates that health eare providers maintain the 
eonfidentiality of medieal reeords and sets the authority for the release of the reeords in 
aeeordanee with the seetion or by other law. 

Seetion §4-303 allows for the diselosure of medieal reeords upon the request of 
the owner of the reeords (patient). The seetion outlines the eonsensual proeess and 
requires eertain information regarding the authority to be in writing. The written authority 
is to inelude the period of time for whieh the authorization to release the reeords is valid 
(not to exeeed one year). The one exeeption to the time limit is for oases in whieh the 
patient was referred for treatment by a oriminal justioe entity, suoh as a oourt. In these 
oases, the length of release authority extends until 30 days following the final disposition 
of the ease. 126 xhe seetion of the Code titled “Disolosures without authorization of person 
in interest” (§4-305) is a state law similar in struoture to the exoeptions provided in the 
federal Privaoy Rule. This seetion also allows for disolosures, whieh are permissive, and 
not mandatory. The first line of the seetion reads, “This seetion may not be oonstrued to 
impose an obligation on a health eare provider to disolose a medieal reoord.”i27 Sub- 
seotion 3 allows for the diselosure of medieal reeords “to a government agenoy 
performing its lawful duties as authorized by an aot of the Maryland General Assembly or 
the United States Congress.”128 xhe sub-seetion notes that further restrietions will follow 
in a subsequent sub-seetion related to the diselosure of mental health reeords. The 


^26 State of Maryland, 22. Medical Records Act—Duty to Hold Confidential and Duty to Disclose a 
Medical Record, Health-General Article § § 4-301—4-309, 8-601. 

126 Ibid. 

127 Ibid. 

128 Ibid. 
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section, otherwise, permits the release of medical records by a provider to other 
government agencies in Maryland or federal government agencies by the provider 
without the authorization of the patient. Sub-section 6 goes on to authorize (permissive 
and not mandatory) the release of medical records if the provider “makes a professional 
determination that immediate disclosure is necessary to provide for the emergency health 
care needs of a patient.” What is of note concerning this area of the law is that it provides 
no interpretation of circumstances, and leaves the decision up to the provider. 129 

Section §4-306, titled “Disclosures without authorization of person of interest— 
Investigations,” is similar to the Privacy Rule’s 45 CFR Part 164 Subpart E §164. 512 
paragraph (f) in that it addresses compulsory disclosures in response to legal processes to 
include action needed to satisfy a subpoena, search warrant, or court order. These 
occasions involve a mandatory release of otherwise protected information in response to 
a legal order. 

The second part of §4-306 involves permitted disclosures without the consent or 
authorization of the patient. Sub-section (b) (1) reads as follows: 

(b) Permitted Disclosures, —A health care provider shall disclose a 

medical record without the authorization of a person of interest: 

(1) To a State or local government, or to a member of a 
multidisciplinary team assisting the unit, for the purposes of 
investigation or treatment in a case of suspected abuse or neglect of a 
child or adult, subject to the following conditions: 

(i) The health care provider shall disclose only the medical record 
of a person who is being assessed in an investigation or to whom 
services are being provided in with Title 5, Subtitle 7, or Title 14, 

Subtitle 3 of the Family Law Article; 

(ii) The health care provider shall disclose only the information in 
the medical record that will, in the professional judgment of the 
provider, contribute to the: 

1. Assessment of risk; 


129 Maureen O’Brien, “HIPAA vs. Probable Cause—Bridging the Communieation Gap” (PowerPoint, 
Praetitioner Legal Training, Montgomery County, Maryland, June 23, 2016). 
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2. Development of a serviee plan; 

3. Implementation of a safety plan; or 

4. Investigation of the suspeeted ease of abuse or negleet; and 

(ill) the medieal reeord may be diselosed as provided in §§ 1-201, 

1-202, 1-204, and 1-205 of the Human Serviees Artieled^o 

Section 7 of paragraph (b) permits health care providers to release protected information 
to grand juries, prosecution agencies, LE agencies, or their agents in furtherance of a 
prosecution or investigation. The section of the law does, however, require that the 
receiving agency has written procedures in place designed to protect and safely store and 
use the information. 

Section §4-307 is the area of Maryland law that discusses the release of mental 
health records. Maryland duty to protect laws are discussed in a later chapter of this 
thesis. The statute separates mental health medical records from the personal notes of the 
provider. Personal notes are defined as “the work product or personal property of a 
mental health provider.”i3i Personal notes must be kept separate from records, and may 
not include information concerning diagnosis or treatment. 

Paragraph (j) of the section addresses disclosures in relation to the health, safety, 
or protection of others, (j) (1) 2. (ii) connects directly with Maryland’s duty to protect 
provision’s Courts and Judicial Proceedings Article Section §5-609, which is discussed in 
the duty to warn chapter of this thesis. 

Section §4-308 absolves a health care provider from “any cause of action” for 
either disclosing or not disclosing a medical record if that action was taken in compliance 
with the law. 

C. ANALYSIS OF MEDICAL RECORDS AND CONFIDENTIALITY LAWS 

AND CVE 

Federal and state medical privacy laws protect patient’s PHI from disclosure. 
Patients have a need to feel that their private information is safe. Medical practitioners 

State of Maryland, 22. Medical Records Act—Duty to Hold Confidential and Duty to Disclose a 
Medical Record, Health-General Article § § 4-301—4-309, 8-601. 

131 Ibid. 
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need their patients to disclose full details of their patient’s condition to diagnose 
accurately and create treatment plans. As evidenced by the Hippocratic Oath, medical 
practitioners operate under strict ethical and legal mandates to protect their patient’s PHI 
from outside entities, including government. However, even laws designed to keep 
personal information private have exceptions built in to balance the individual’s right to 
privacy with the welfare of the public. CVE practitioners involved in intervention 
programs will be on the razor’s edge of this balance. 

As CVE intervention and diversion programs very much involve a mental health 
and medical component, which is balanced with the public safety component, a clear 
understanding of applicable laws is vital. CVE programs must balance confidentiality 
with the protection of the public. 

CVE programs include partnerships with NGOs and public agencies with multiple 
functions. The balance of applying privacy laws in an environment including multiple 
agencies with varying functions presents a challenge. CVE programs also represent what 
the Privacy Rule refers to as hybrid entities. As such, it is the responsibility of the 
program to decide which portions of the structure are bound by the Privacy Rule, and 
separate the different components of the program to comply with the law. 

In terms of disclosure of PHI, the Privacy Rule only mandates two circumstances 
of an affirmative obligation to disclose PHI. One instance involves open access of PHI to 
the patients themselves, and the other involves releasing PHI to DHHS for the purpose of 
auditing compliance with the law. Eederal and state laws require that CVE intervention 
programs properly record and store medical information related to their clients. Both sets 
of laws dictate the requirements of record retention and storage. Clients receiving 
services from CVE programs have the right to review their medical records under the 
law. CVE programs are also required to explain the law to their clients. Programs must 
also be prepared to release medical records to DHHS in the event of an audit to ensure 
that the federal law is being followed. 

One of the easiest ways to disclose PHI is with the patient’s consent. The Privacy 
Rule requires written permission from the owner of the PHI. Some CVE programs might 
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use written eonsent when a elient enters the program that would be in eonjunetion with an 
explanation of the rights afforded to the patient under the Privaey Rule and applieable 
state laws. It would also involve information on how the patient eould revoke the eonsent. 
In eases where a patient is referred to a CVE program by a eourt system, eonsent on the 
part of the patient may be ineluded in the referral if the eourt orders partieipation in the 
program. 

One of the interesting exeeptions to eonfidentiality in the Privaey Rule involves 
the sharing of de-identified PHI. The Privaey Rule provides elear instruetion on what 
eonstitutes de-identified PHI. Aeeording to the Privaey Rule, there are no restrietions on 
the use of de-identified PHI. The Privaey Rule refers to the use of de-identified PHI as 
the “safe harbor” use. It is possible that CVE praetitioners may use de-identified PHI to 
diseuss otherwise restrieted information eoneerning elients with other praetitioners. In 
sueh eases, where other options are not available, it may be possible for mental health 
praetitioners to discuss particular details concerning a client if all information that 
identifies the patient is removed from the discussion. Under these circumstances, the 
practitioner would be responsible for ensuring that the discussion did not include any 
details that could be used to identify the patient. 

The most applicable portion of the Privacy Rule that has an impact on the ability 
of CVE practitioners to communicate details of potentially violent clients falls under the 
section describing the permissible exceptions to the Rule. The Rule begins explaining the 
exceptions by stating that they are restricted by the application of other laws or ethical 
standards. In other words, the exceptions exist when not restricted by other laws. The 
exceptions are required to balance the need for confidentiality with the obligation to 
protect other persons or the public. 

Of the sections describing allowable exceptions to confidentiality, the section 

discussing government functions is most applicable to situations likely to be encountered 

in a CVE environment. The Rule allows for the disclosure of PHI without the patient’s 

consent for certain government functions, including intelligence and national security 

functions. When other avenues permitting disclosure are exhausted, this section may 

allow practitioners to disclose information concerning clients who pose a risk to others by 
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violent means. Similar to other laws discussed, this section of the Privacy Act is broad 
and leaves much open to discretion and interpretation; however, the language makes it 
clear that the federal government’s authority to conduct intelligence and national security 
investigations is an exception to the Rule. It is important to remember that this exception 
is permissive and not mandatory, but the language of the Privacy Act leaves open the 
possibility for CVE practitioners to disclose PHI to the federal government in cases 
where the client poses a risk to others or the national interest. 

Maryland state law applying to the confidentiality of medical records is similar, 
and in many ways, mirrors the federal law. As with the federal law, Maryland state law 
begins by defining what and who are covered by the law. Based on Maryland’s legal 
definitions, CVE practitioners administering mental health services, including therapists 
and counselors, would be covered by the law. Maryland’s law also covers the use of 
consent by the patient as a means to use or disseminate medical information. 

Eikewise, the section of Maryland law addressing disclosure without the 
authorization of the “person of interest,” is similar to the Privacy Rule. One broad 
difference is that Maryland law permits the disclosure of medical record information to 
government agencies “performing their lawful duties.” As with other aspects of both 
federal and state law, the exception is permissible and not mandatory unless required by 
other laws. 

Maryland separates mental health records into a separate section of the law. 
Similar to the minimally reasonable standard of the Privacy Rule, Maryland law 
mandates that mental health information released must only be relevant to the purpose of 
the disclosure. Maryland health confidentiality law refers to the legal section covering 
mental health records when referring to disclosure. 

Based on both federal and Maryland state law on the use and disclosure of PHI, it 
appears that the laws provide broad guidance on exceptions allowing for disclosure. In 
some circumstances, these conditions and what they mean may present confusing 
circumstances for practitioners. 
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III. THE DUTY TO WARN AND PROTECT 


Like other medieal health professionals, mental health professionals have an 
ethieal and legal obligation to protect their patient’s confidentiality. As with other health 
disciplines, this obligation is designed to facilitate a trusting relationship. While the 
protection of patient privacy is critical, and mandated by law, exceptions are built into the 
law. Some of the exceptions are permissive in nature, and some are obligatory. The 
exceptions, especially the mandated exceptions, are designed to balance confidentiality 
with the prevention of danger to the public. A legal requirement for mental health 
practitioners to warn or protect a third party from the actions of their patient is one such 
mandatory exception in many states. 

The most simple definition of the term duty to warn is that social workers, 
therapists, or another mental health workers have an ethical and legal obligation to warn a 
third party of a potential danger presented by the therapists’ client. 132 xhe term duty to 
protect implies that the therapists have a larger obligation to take additional steps to 
protect a third party from their patients when they have reason to believe that the patients 
pose a violent threat to the third party. “The general rational on which such laws are 
predicated holds that certain individual rights must give way to the greater good of 
society or to the rights of a more vulnerable individual (e.g., in child abuse or child 
custody cases).”133 In terms of a state licensed therapist’s duty to warn or protect, the 
legislation only resides at the state level. No federal law mandates a duty to warn or 
protect. 

In his article, “Confidentiality and the Duty to Warn: Ethical and Legal 
Implications for the Therapeutic Relationship,” James Corbin speaks of the nature of 
confidentiality and the friction it may cause between the field of mental health and other 


132 Granich, “Duty to Warn, Duty to Protect.” 
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disciplines, such as elements of our legal system. 134 Corbin concedes that outsiders may 
pereeive mental health as an unreliable seienee and that mental health practitioners may 
view laws and the legal system as foreign and contrary to the aims of their profession. 135 
Corbin describes the unavoidable intersection of the two worlds. As a result, the 
importance of cross training and knowledge of both systems is important to practitioners 
in both fields. 136 

Scholars David Wexler and Bruce Winick coined the term “therapeutic justice” to 
describe a problem-solving process used to bring the two fields closer together. 137 

Therapeutic jurisprudence describes the problem-solving proeess between 
two systems—a study on the impact of the system of law on mental health, 
as well as the impact of the soeial sciences on law.i38 

The mental health system and our nation’s eriminal justice systems (as 
well as eivil court systems) depend on the expertise and knowledge base 
from eaeh respeetive diseipline, as well as the prudence of those 
speeialists who have combined expertise, in attempts to address and solve 
problems. Both fields inform the practice of one another. 139 

The theory of duty to warn or proteet is one issue that is frequently a point of contention 
between practitioners of mental health and the legal system. 

Mental health practitioners are bound by the same legal and ethical rules as other 
health professionals. The Ameriean Psyehiatrie Assoeiation published “The Prineiples of 
Medical Ethics with Annotations Especially Applicable to Psychiatry,” which outlines 
the ethical code of mental health professionals. 

Section 4 of the code states, “A physician shall respect the rights of patients, 
colleagues, and other health professionals, and shall safeguard patient confidences and 
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privacy within the constraints of the law.’’^'^*’ The seetion also describes how mental 
health records must be protected with a high level of care and that a psychiatrist may only 
release the reeords with the permission of the patient or “under proper legal 
eompulsion.”i4i As important as the theory of confidentiality is to health care as a whole, 
the issue is magnified in the realm of mental health care. “The confidential relationship 
between mental health professionals and their clients has long stood as the cornerstone of 

the helping relationship.”142 

The need for confidentiality in psyehotherapy has been described as a 
“cornerstone” upon whieh therapist and elient relationships are built. 143 Confidentiality is 
usually described as the restriction placed upon the disclosure of information by the 
mental health provider outside of courtroom settings, where the praetitioner’s testimony 
is demanded. “Confidentiality refers to a general standard of professional conduet that 
obliges a professional not to discuss information about a client with anyone”i44 As with 
regular health care, a difference exists between confidentiality and privilege in the realm 
of mental health eare. Privilege refers to the legal immunity that certain speeific types of 
relationships, sueh as therapist/client relationships, enjoy from testifying in eourt.i45 As 
noted in the ehapter on HIPAA, this thesis does not delve into the concept of privilege, 
and instead focuses on the issues surrounding the theory of confidentiality. 

The confidential relationships between psyehotherapists and their elients are 
considered sacrosanct for very good reasons. When establishing a healing or helping 
relationship with a therapist, trust in an essential element. If potential patients believe that 
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professionals will disclose the personal experiences that they share during therapy, many 
persons needing treatment may choose not to seek help. The successful treatment of 
ailments requires that patients fully disclose their symptoms for the provider to diagnose 
the illness successfully and construct a treatment regimen. An argument for the protection 
of confidentiality recognizes that patients who do not trust the confidential nature of the 
relationship they have with their therapist may not fully disclose information needed to 
diagnose and treat their conditions.!'^® 

Since duty-to-warn or -protect statutes, and subsequent interpretations by the 
judicial branches, exist at the state level, the laws and their application between states 
vary greatly. As shown in Figure 2, the states may be divided into the following three 
categories: states that mandate a duty to warn or protect, states that have permissive laws 
that allow therapists to warn or protect third parties, and states that have not enacted 
legislation concerning any duty to warn or protect, Each of these three categories 
presents therapists with certain obstacles that must be overcome for the therapist to treat 
their patients successfully and follow legal guidance. 
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Figure 2. State Duty to Wam/Protect Laws.'"^^ 


In states with mandatory statutes, therapists must regulate the trusting relationship 
with their patients and also make a determination on whether patient disclosures rise to 
the level to which the law mandates a duty to warn or protect. In determining whether the 
therapists must discharge the duty to warn or protect, the therapists must evaluate the 
level of risk posed by their client and decide if it rises to the level required by that state’s 
specific guidance. Different states also make other requirements affected by the 
imminence of the potential threat, and whether the indented victim is known. 1^9 

Therapists who work in states with permissive statutes face even more 
challenging decisions. 

Therapists in states with permissive statutes have several legally 
acceptable options when a patient makes a violent threat against an 
identifiable victim: continue therapy as planned without issuing any 


Source: “Mental Health Professionals’ Duty to Warn,” September 28, 2015, http://www.ncsl.org/ 
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warning, change the therapy to eontain the threat and proteet the potential 
vietim, warn law enforeement, warn the vietim, warn the vietim and law 
enforeement, or determine if there are grounds for eivil eommitment based 
on the patient’s dangerousness to others. 

In states with permissive legislation and law interpretations, the first two options 
present several legal and moral eomplieations. If the therapist does not warn or notify the 
proper authorities and a third person beeomes a vietim, the therapist may be legally 
responsible sinee most states with permissive laws only eover the therapist from liability 
when a warning is made. Many of these state laws do not eover the therapist from 
liability when eonfidentiality is not breaehed, when valid reasons to warn, and then a 
third party vietim is ereated. From a therapeutie standpoint, moral and treatment 
eonsiderations may prevent the therapist from making a permissive notifieation, even 
when diseharging a permissive duty to warn may be the safest eourse of aetion. “This 
moral basis serves as the foundation for legal duties to proteet, whieh speeify eases where 
legal requirements of elinieian-patient eonfidentiality are removed to allow a elinieian to 
try and avert harm to an identifiable vietim.”i5i 

The third type of jurisdietion involves states with no statutory law or legal 
guidanee. These states ereate a more ehallenging environment for therapists than the two 
previous eategories. Without an affirmative duty to warn or proteet, or a legal permissive 
ability to breaeh eonfidentiality, therapists in these states are in a very preearious 
position. If therapists breaeh eonfidentiality, they may be open to eivil litigation. If the 
therapists fail to warn a potential vietim, they may also be open to eivil litigation. These 
two possibilities are in addition to the eomplexities involved in treating patients with 
violent potential, and preventing them from vietimizing others. 

A, TARASOFF—THE ORIGIN OF DUTY TO WARN 

The terms “duty to warn” and “duty to proteet” were born of a series of ineidents, 
and subsequent legal maneuvers, in California in the late-1960s and mid-1070s. The 
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events of eoneem were litigated in the California ease of Tarasoff v. Regents of 
University of California. 1^2 case involves the murder of a woman at the University of 

California (UC) Berkeley by a student who had been under psyehiatrie eare. This seminal 
ease was the first to use the terms “duty to warn” and “duty to proteet” in legal 
jurisprudenee. It is also the forerunner of all eurrent duty-to-wam and -proteet state laws. 
As a result, the topie of duty to warn or proteet is frequently referred to as relating to 
Tarasoff, even though the Tarasoff ease only direetly applied to the state of California. 

The details are eompelling. Tatiana Tarasoff, also known as Tanya, was bom in 
China to Russian parents, as shown in Figure 3. The family then moved to Brazil until 
reloeating to Berkeley, California, in 1963 . 1^2 



Figure 3. Tatiana Tarasoff. ^ 


Prosenjit Poddar, seen in Figure 4, was raised in a small village in northern India 
and was a member of the Harijan (untouehable) easte. Poddar graduated from the Indian 
Institute of Teehnology in 1961 and reloeated to Berkeley in 1967 as a graduate student 


152“j^rasoff v. Regents of University of California—17 Cal. 3d 425—Thu, 07/01/1976|Califomia 
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studying naval architecture. Poddar lived in the International Student House (ISH) at UC 
Berkeley. 



Figured. Prosenjit Poddar. 1^6 


It has been reported that Poddar experienced a hard time transitioning from his 
home culture to American culture. This challenge was probably made more complicated 
by his being born into, and raised, in the Harijan caste. It was noted that Poddar, who had 
previously attended all-male schools, was especially challenged by the cultural 
differences in terms of relationships with women. 1^7 

In 1968, Tarasoff and Poddar met at the ISH while Tarasoff was attending folk 
dancing classes. On New Year’s Eve, Tarasoff kissed Poddar, which led him to believe 
that she was interested in him romantically. When Poddar pursued Tarasoff, she declined 
his advances. Poddar became infatuated with Tarasoff. When Poddar learned that 
Tarasoff was engaged in sexual relationships with other men, his mental condition began 
to decline. Poddar began missing classes and work, and began spending time alone in his 
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room. In the summer of 1969, Tarasoff left to spend the summer in Brazil. While she was 
gone, a friend of Poddar’s eneouraged him to seek treatment. 1^8 

Poddar sought help at Cowell Memorial Hospital at UC Berkeley. During 
treatment under the supervision of Dr. Lawrenee Moore, Poddar diselosed that he was 
going to kill a woman named Tatiana. Case law indieates that the intended vietim was 
“readily identifiable” by Moore.Moore diagnosed Poddar with paranoid sehizophrenia 
and eonsulted with eolleagues. Believing that Poddar presented a danger to himself and 
others, Moore eontaeted the UC Berkeley poliee and asked that they take Poddar into 
eustody. Moore further advised that he would eommit Poddar. Campus poliee offieers 
detained Poddar in his room. During the eneounter, the poliee offieers determined that 
Poddar appeared rational, instrueted him to stay away from Tatiana, and did not transport 
him for eommitment. Moore’s supervisor instrueted that all therapy notes be destroyed 
and instrueted that no further attempts to eommit Poddar be attempted. Poddar stopped 
partieipating in treatment, 

Upon her return to Berkeley, Tarasoff was open eoneeming her romantie 
eseapades in Brazil. Upon learning of Tarasoff s involvement with other men, Poddar’s 
mental state eontinued to deteriorate. On Oetober 27, 1969, Poddar armed himself with a 
pellet gun and a knife, and went to Tarasoff s residenee. Poddar ehased Tarasoff into the 
baek yard and fatally stabbed her 17 times. Poddar then went baek inside and ealled the 
poliee, who responded and arrested him.i^i 

Poddar was initially eharged with murder, and was eonvieted of seeond-degree 
murder in spite of his defense of insanity. Poddar appealed, and a California Court of 
Appeals lowered the initial eonvietion to manslaughter. A new trial was ordered when it 
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was determined that the judge in the first case failed to provide adequate instructions to 
the jury concerning the issue of diminished capacity. Poddar was never re-tried, and 
California ultimately allowed him to leave the United States and return to India. 1^2 

TarasofP s parents later brought a civil suit against the University of California for 
wrongful death. The initial case was dismissed, and the Tarasoffs appealed. The 
California Court of Appeals affirmed the lower court’s decision and found in favor of the 
defendants, that is, the university. The case was appealed again in front of the California 
Supreme Court. This time, the court agreed with the Tarasoffs and determined that the 
defendants should have warned Tatiana of the risk. In doing so, the California Supreme 
Court applied the legal theory of “duty to warn” to the therapists. ^ 

Due to the controversial nature of the court’s first opinion, and in an unusual 
maneuver, the California Supreme Court agreed to take a second look at its Tarasoff 
decision. 164 As unusual as it was for the California Supreme Court to agree to a rehearing 
of the case, it became even more unusual when the second decision expanded on the 
decision of Tarasoff 1. The decision in Tarasoff 2 expanded the duty to warn in decision 
of Tarasoff 1 to the “duty to protect.” The case decisions are sometimes referred to as 
Tarasoff 1 and Tarasoff 2.165 

Tarasoff 2 looked at all the causes for action claimed by the plaintiffs (Tarasoffs), 
and decided to focus on one, the “Failure to warn on a dangerous patient.”i66 The 
defendants in the case contended that they had “no duty of care to Tatiana or her parents 
and that in the absence of such duty, they were free to act in careless disregard of 
Tatiana’s life and safety. 
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In its analysis, the court determined that the most important consideration in terms 
of a failure to warn on behalf of the defendants was the issue of foreseeability. According 
to the opinion provided by Judge Tobriner in the case, “As a general principle, a 
‘defendant owes a duty of [17 Cal. 3d 435] care to all persons who are foreseeably 
endangered by his conduct, with respect to all risks which make the conduct 
unreasonably dangerous.The court further noted that historically, affirmative action 
had been required if the defendant had a “special relationship” with either the individual 
posing a danger, or the intended victim. The relationship between a therapist and a patient 
qualified as a special relationship, which left the issue of whether therapists should have 
foreseen their client’s future action.^® 

The defense counter-argued that therapists cannot predict whether a patient will 
act violently in the future with any degree of accuracy, and, in fact, practitioners likely 
would over-report their concerns. 

In support of this argument amicus representing the American Psychiatric 
Association and other professional societies cites numerous articles which 
indicate that therapists, in the present state of the art, are unable reliably to 
predict violent acts; their forecasts, amicus claims, tend consistently to 
over-predict violence, and indeed are more often wrong. I’^i 

The court determined that making diagnoses is a central function of psychiatrists 
and psychologists, and in doing so, these practitioners do routinely make predictions. 
According to the court’s decision, “Thus the judgment of the therapist in diagnosing 
emotional disorders and in predicting whether a patient presents a serious danger of 
violence is comparable to the judgment which doctors and professionals must regularly 
render under accepted rules of responsibility.court did recognize the difficulty 
inherent in the process of predicting behavior, and noted that a perfect performance on 
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the part of therapists was not expected or necessary. The actions of a therapist in making 
predictions must only be reasonable in the context of the circumstances and as 
comparable to others in the field. The court also pointed out that the defendants in the 
Tarasoff case did accurately predict Poddar’s violent behavior and the threat he posed, 
but failed to warn or protect the victim. 

The significant conclusion of the court’s decision was the determination that once 
a therapist does determine that a patient poses a threat to another (or should have 
determined based on the reasonableness of the circumstances and common practice), the 
therapist is responsible to act upon a duty to protect the threatened party. 1^3 
expansion of the duty to warn to a duty to protect increases the affirmative action that a 
therapist must take to protect a third party by imposing duties in addition to a warning. 
The court opined that the risk of predicting false warnings was overshadowed and made 
reasonable by the potential for the saving of lives and protecting third parties from 
danger. 

In regards to the crucial nature involved in protecting confidential 
communications between therapists and their patients, the court acknowledged the 
importance of confidentiality and the role it plays in the successful treatment of patients, 
but weighed the interest of the confidentiality against the welfare of the public and the 
need to protect the public from future acts of violence. 

In providing the majority decision for the case. Judge Tobriner authored the now 
famous lines, “We conclude that the public policy favoring protection of the confidential 
character of patient-psychotherapist communications must yield to the extent to which 
disclosure is essential to avert danger to others. The protective privilege ends where the 

public peril begins. 
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B, MARYLAND DUTY TO WARN AND PROTECT LAW 

Maryland is a mandatory duty-to-protect state. The affirmative nature of the duty 
may differ from other states in that it provides for options in whieh a therapist may act 
and does not specifically dictate which option the therapist must choose. The statute is 
located in Maryland’s Courts and Judicial Proceedings Section §5-60.1^^ 

Section (a) of the statue defines to whom the law applies. Mental health care 
providers who must be licensed in the state are covered by the law. Definitions of who 
must be licensed are provided in the Health Occupations Statute under Section §17- 
101.1^^ Licensing requirements for social workers may be found under the Health 
Occupations Statute under Title 19-Social Workers Subtitle 3-Licensing Title §19-301.1^^ 

Section §5-609 defines a mental health care provider as, “a mental health care 
provider licensed under the Health Occupations Article or any facility, corporation, 
partnership, association, or other entity that provides treatment or services to individuals 
who have mental disorders. 

Section (b) outlines the mandated duty to protect as occurrences when a mental 
health care provider is aware that a patient is capable of violent behavior against a known 
victim or group of victims. The statue provides immunity from legal or disciplinary 
action of the provider for discharge of the duty to warn or protect. Section (b) also 
describes the manner in which a provider may come to know of the threat posed by a 
patient as the patient’s spoken word, writing, or conduct.i**’ 
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Section (c) (2) provides the options for the discharge of the duty that a provider 
may take. The statue allows for discretion on the part of the provider either to seek 
commitment of the patient, construct a treatment plan to address the potential violence, 
inform a LE agency of the danger posed by the patient, or warn the intended victim(s). If 
the provider decides to provide a warning to LE or the intended victim(s), the stature 
delineates that the warning must include the nature of the threat, identity of the patient, 
and the identity of the intended victim(s). As a result, Maryland’s law is both a duty to 
warn and a duty to protect statute. The law is mandatory in requiring the therapist to take 
action to protect, but allows discretion in how the provider discharges the duty. The law 
also states that the actions taken by the provider must be both reasonable and timely. 

C. ANALYSIS AND APPLICATION TO CVE 

Confidentiality is a vital component of the therapist/patient relationship. Without 
the trusting relationship created by the existence of confidentiality, patients in need of 
treatment may not seek it, patients may not disclose all information needed for the mental 
health worker to diagnose and treat the patient properly, and patients may stop treatment 
(as was seen with Poddar). The reasons for the confidentiality and trust are also a benefit 
to society when they facilitate the successful diagnosis and treatment of the mental health 
patient. 

This balance of trust with the responsibility to protect others from their patient’s 
potential violent acts creates a precarious responsibility for therapists. The element of risk 
lies inherent in both the treatment of the patient and the protection of the public. When 
treating patients vulnerable to radicalization, engaged in radicalization, or radicalized, the 
threat of danger to others and the risk to the patient are always present. 

A therapist must first diagnose a patient before administering treatment. In cases 
where the patient has indicated a threat to others, the therapist must determine if the 
threat is viable. A determination of whether the patient intends to carry out the threat, or 
is just venting frustration must be made. The therapist must determine if the patient has 
the means to carry out the threat. Eor example, a patient threatening to kill his wife with 
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whom he resides may be more eredible than a threat to kill an ex-girlfriend who resides 
on another eontinent. 

Many state laws, sueh as Maryland’s, require that the threat posed by the patient 
be imminent, but provide no definition of what that means. The therapist must determine 
the imminenee of their patient’s threat to another. Without guidanee on what constitutes 
imminent, practitioners are left to their own devices to make the determination. 

As a result, mental health providers are responsible for treating patients suffering 
from mental health disorders, successfully diagnosing the disorder, creating a treatment 
plan, enacting the plan, monitoring the progress and adjusting as necessary, and being 
wary of danger the patient may pose to others. In the situations when the patient poses a 
danger, the practitioners must understand the boundaries of the law in the state in which 
they are practicing, determine if the threat is imminent, and then determine what to do. 
Risk assessment is a constant element in all phases of the therapist’s role. 

Maryland’s duty to protect law applies to CVE practitioners providing therapy to 
referred clients. As licensed social workers or therapists, CVE practitioners are working 
in an environment rife with risk, and are bound by the duty to protect others. As such, 
when licensed mental health providers working in the CVE field in Maryland are treating 
patients, they must determine if the patient poses a threat to others. The threat may be 
communicated in words, writing, or other action. 

Even though Maryland’s law mandates an affirmative action on the part of the 
provider, the law allows for discretion on the part of the provider in the form of options 
which may be applied. In Maryland, providers are not mandated to warn the victim, 
although they may elect to do so. Maryland’s law allows for the provider to address the 
threat by having the patient civilly committed for further treatment, establishing a more 
robust treatment plan, or making notification to the appropriate EE agency and the 
potential victim. 
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Maryland’s duty to protect only applies to future crimes, and does not apply to 
crimes that have already been committed. The law also indicates that the victim, or 
victims, must be identifiable. 1^2 

The decision by a therapist to breach confidentiality remains a challenging issue. 
Identifying risk, and determining the seriousness or level of risk remains critical. A 
possibility exists that therapists, who are ethically and morally bound to protect the 
confidentiality of their patients, may be more inclined to try and treat patients as their 
choice of options, when in fact, the more appropriate response might have been to warn 
the victim and alert LE of the danger. While discretion is important in both mental health 
care and LE, some practitioners may elect to take what they believe is the safer ethical 
route and treat the patient as their response to discharging their protective duty. 

The fields of mental health and LE are frequently misunderstood in general, and 
practitioners in both fields frequently do not possess an adequate understanding or 
appreciation of the other field. Corbin, Wexler, and Winick point out the conflict between 
the two professions while highlighting the importance of cooperation. 1^3 Mental health 
and LE will always overlap. The theory of therapeutic justice seeks to educate 
practitioners in both fields on the work of the other, and bring the two disciplines closer 
together. Both fields possess the same super-ordinate goal of helping others, but a lack of 
understanding or cooperation may block the efforts of one field instead of creating a 
complimentary union. 

Practitioners in both fields are motivated and bound by ethical and moral values. 
Both fields are also impacted by laws that regulate or permit actions taken in pursuit of 
the specific field’s goals, while still under the shadow of the broad goal of helping others. 
Therapists focus on their patients, and LE may focus on victims. The victims are 
sometimes the therapists’ patients, and at other times, victims may be created by these 
patients. In terms of confidentiality and treatment of their patients, therapists are bound 
by both ethical and legal means. It is therefore important for LE professionals to 

1^2 Beth Tabachnick, “Maryland Duty to Protect/Wam” (PowerPoint, CVE Practitioner 
Confidentiality Training, Montgomery County, Maryland, 2016). 

183 Wexler, “Two Decades of Therapeutic Jurisprudence,” 17. 
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understand the role of the therapist and the benefit to soeiety of the sueeessful treatment 
provided by the therapist. The therapist, on the other hand, must understand that at some 
point, the proteetion of society may outweigh the individual patient. In short, a balance 
must exist between the obligation the therapists have to their clients and the safety of the 
public. As noted by the second Tarasoff decision, the balance must always tip in favor of 
public safety as a whole. The protected privilege, should in fact, end where the public 
peril begins. 
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IV. MULTI-DISCIPLINARY APPROACH 


CVE programs are designed to operate as eollaborative entities. The models bring 
together various entities and experts who may not normally work together. The models 
are designed to apply all the eorreet resources deemed necessary to achieve the goals of 
the program. This approach does, however, create challenges for organizing, managing, 
and ensuring the entities complement each other, remain focused on the goal, and 
collaborate effectively. Two of the main groups involved in CVE are represented by EE 
and mental health practitioners. As referenced earlier, conflict and cooperation between 
the two groups have previously existed in various venues. CVE adds additional 
ingredients to the pot by including additional resources and disciplines. Eortunately, 
collaborative models have been used successfully in other areas. 

As the FBI has prepared to refer individuals to CVE programs for intervention, 
the agency has begun referring to the intervention practitioners as a MDT. The definition 
fits, but as shall be seen, the method and application as used by the FBI may not be 
appropriate. 

For many years, different fields have relied on multidiscipline efforts to find the 
best approach to a super-ordinate goal. MDTs are sometimes also referred to as 
interdisciplinary teams, but the two are actually somewhat different, and the definition 
sometimes depends on the discipline in which it is used. MDTs have historically been 
used in the fields of private industry, health care, special education, and for child abuse 
investigations. 

MDTs are typically composed of a group of professionals from different fields 
who share a common goal, but contribute different areas of expertise to the effort. In the 
field of medicine, interdisciplinary teams may be defined as, “a group of healthcare 
professionals from diverse fields who work in a coordinated fashion toward a common 
goal for the patient,” as opposed to a MDT defined as, “a team of professionals including 
representatives of different disciplines who coordinate the contributions of each 
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profession, which are not considered to overlap, in order to improve patient care.”!^"^ In 
the United States, MDTs have been used in hospitals for more than 50 years. 

The MDT approach identifies practitioners with critical responsibilities to an 
issue, and brings those practitioners together to form a team. The practitioners represent 
agencies that have a stake in the solution of the challenge. The practitioners are brought 
together as subject matter experts on their aspect or interest in the issue. The goal is to 
form a team of experts where each expert represents a different discipline for the purpose 
of collaborating on complex challenges. One of the assumptions of the effort is that 
individual practitioners would not benefit from the expertise of team members from 
different disciplines if the team was not formed. The practitioners represent each of their 
disciplines and work to collaborate the efforts of their organizations with the partner 
agencies. The goal is to create a common plan to overcome a challenge and identify the 
role of each discipline. 

MDTs have been used in the United Stated for several decades, with a high level 
of success, in the area of physical and sexual child abuse. The MDT approach was first 
applied to child sexual abuse in the 1980s by the National Children’s Advocacy Center 
(NCAC) in Huntsville, Alabama. At the time, social services providers, members of the 
criminal justice system, and LE officers were not effectively working together to address 
child sexual abuse issues. Members of these different disciplines pursued the same super¬ 
ordinate goal of protecting children, but the services provided were different, and what 
others were doing was not clear, or the mission of other practitioners was not really 
known either. A district attorney and now former Congressman from Alabama, Bud 
Cramer, recognized the lack of coordination, and assisted in forming MDTs with the 
various disciplines. Cramer organized representatives from the fields of child protective 
services (CPS), LE, medical and mental health practitioners, and attorneys and formed 
the first MDT for assisting child victims. The formation of the MDT also created the first 
child advocacy center (CAC), which evolved into a coordinated center where all aspects 

Free Dictionary, “Multidisciplinary Team.” 

Mark Ellis, Forming a Multidisciplinary Team to Investigate Child Abuse (Washington, DC: U.S. 
Department of Justice, Office of Justice Programs, Office of Juvenile Justice and Delinquency Prevention, 
2000), 4, http://papers.ssm.com/sol3/papers.cfm?abstract_id=2518713. 
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involved with the response to sexual erimes committed against children, as shown in 
Figure 5, could be addressed.'*^ 


HOW THE MULTIDISCIPLINARY TEAM RESPONDS TO CHILD ABUSE 



District Attorney's Offtco 


9 Responds 10 reporis of cMd abuse. «wesa9ates the aDe^abons n oonjimDon with law enfa ce ment and wonts lo ensure chMren are safe 
O Responds to reports of chid abuse, nvesOQates the allegations n conjiaKbon with DHR, and makes arrests appropriate 
^ Interviews chddren who may have expentneed abuse, usmg a natranaly-recognized forensic mirview model developed by NCAC 
O Rtovides non-invashe phy»cal exams for cNdren with ale^aOoni or concerns of abuse 

^ Provides the parerts/care9Vtrs of children who paroopate in a forensc interview with support and educabon about the investipatcn and crimnal 
jutboe process, ongoing support and Inkage to commuiity resources 

9 Reviews cases with members of lAjlbdtsapinary Team to gude die chU abuse nvesbgabons. (Memiines whether proeecuton n crmnal court a 
appropnate. and prepares cases for tnal 

^ Provides evidence-based and trauma-focused mental healtn treatment to children who have experienced abuse or other traumalizvig events 


Figure 5. NCAC Organizational Chart. 


According to the NCAC: 

This innovative model recognized that in order for the United States to 
effectively respond to this issue that a unique public-private partnership 
was essential, and that the various agencies and departments responsible 

186 “National Children’s Advocacy Center History,” accessed July 11, 2016, http://www.nationalcac. 
org/table/about/history/. 

Source: National CAC, “Multidisciplinary Team.” 
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for the protection of children must be united in a collaborative effort to 
respond with the recognition that no one agency by itself could assure the 
protection of children.!^* 

This new approach was received with a certain amount of uncertainly by members 
of the different involved groups. Eventually, members of the MDT grew to appreciate the 
strength of the team. A greater understanding of different roles and an appreciation for 
the collaborative approach became obvious. Since that time, the CAC model of MDT has 
spread to over 950 CACs in the United States and to over 25 other countries. 

The investigation and response to the report of child abuse is a complicated and 
complex endeavor that necessitates the involvement of numerous different professionals 
from various different disciplines. The members of each area represent different, but 
aligned, missions with the same goal of protecting and assisting the victim. 

LE is obviously tasked with the investigation of reported child abuse crimes. CPS 
social workers also investigate the reports of abuse and neglect, and frequently do so in 
conjunction with EE. Interviewing children in general, and especially children who may 
be the victims of horrible crimes, requires a very specialized skill set. CPS social 
workers, who are typically specially trained to conduct interviews with children, often 
conduct the interviews on behalf of EE. In the world of EE, it is rare that a professional 
from another field is relied upon so heavily to contribute such an important part of an 
investigation. As a result, a strong relationship between the EE and CPS workers is more 
than essential. 

Medical and mental health professionals are brought into the equation to provide 
treatment, but are also used to gather both physical and testimonial evidence. In 
jurisdictions with CACs, specially trained pediatricians and nurses work in the Center to 
assess, treat, and document injuries and evidence in conjunction with their evaluation of 
the victim. In other jurisdictions, the victims are brought to a hospital where the attending 
physician may, or may not, have experience in treating the victims of child abuse, or 
sexual abuse. 

188 National CAC, “Multidisciplinary Team.” 

189 Ibid. 


68 



Prosecutors and government attorneys representing children also have a place in 
the response to child abuse. In many jurisdictions, when responding to crimes of a serious 
nature, prosecutors are frequently involved in the investigation. When dealing with the 
unique and fragile nature of child abuse investigations, prosecutors are frequently 
involved to assess the value of evidence and provide guidance. Other government 
attorneys are also involved in other legal areas involving children, such as custody and 
civil court proceedings. 

When addressing matters representing a high level of seriousness, such as child 
abuse, teamwork is essential. To accomplish overall goals, the creation or formation of a 
team is very important. In addition to coordinating the various roles of team members, 
well-functioning child abuse MDTs frequently move into the arenas of group decision 
making, policy evaluation and recommendations, and coordinated strategies to apply to 
individual cases. 

Some of the recognized benefits to child abuse MDTs include: 

• Leaner and more efficient use of scarce resources 

• Better decisions made by groups with pertinent and multifaceted 
experience 

• Better investigative, prosecutorial, and treatment outcomes 

• Better understanding of roles and responsibilities leading to increased 
positive outcomes 

• A higher level of community respect 

• Lower levels of burnout and turnover among team members 

• Lower amount of exposure to multiple agencies by victimsi^i 

Once the importance of the use of MDTs in child abuse investigations has been 
accepted, the next step involves the creation and maintenance of a team. Critical steps to 
forming a MDT include: 

• Identifying and recruiting members 

Ellis, Forming a Multidisciplinary Team to Investigate Child Abuse. 

191 Ibid., 4. 
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• Creating and writing a mission statement 

• Creating and writing polieies and protoeols 

• Evaluating the impaet of laws on the group’s mission 

• Establishing and maintain relationships 

192 

• Evaluation 

In Montgomery County, the MDT design is used for ehild abuse investigations 
and treatment plans. Any member of the team has the authority to eall a MDT meeting to 
present issues related to a ease for the team to discuss with the intent of producing a 
collective agreement on a path forward. 

The model brings together representatives from the County’s DHHS’ child 
welfare services, police department. State’s Attorney’s Office, County Attorney’s Office, 
and the Primary Care Coalition of Montgomery County. The team is a public private 
partnership. According to the Montgomery County memorandum of understanding and 
operational agreement for the Tree House Child Assessment Center of Montgomery 
County, Maryland; 

This agreement is set forth to enable the Montgomery County 

Multidisciplinary Team to pursue the well-established process of the 

interdisciplinary approach to cases of child maltreatment which includes, 

but is not limited to the following: 

A. Sharing information and resources to enhance each step of the case 
intervention process. 

B. Responding effectively and efficiently to all child protection issues 
of mutual concern. 

C. Ensuring that victims and their families receive community-based 
services in a timely fashion in order to reduce the stress on the 
family system. 

D. Providing an environment to allow each discipline to bring the 
training, experience and resources to the table to address child 
maltreatment and case management. 


Ellis, Forming a Multidisciplinary Team to Investigate Child Abuse. 
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E. 

Monitoring collaborative case management and service provision 
to ensure quality of treatment to support healthy outcomes. 

E. 

Enhancing communication between and among 
operations. 

all 

MDT 

G. 

Providing opportunity for feedback on Tree House 
operations. 

and 

MDT 

H. 

Conducting peer reviews for all Tree House staff. 193 




The negative eonsequenees of the failure of teamwork and cooperation among 
disciplines involved in the investigation and response to child abuse involve the 
continuation of child victimization and the possible failure to detect cases of child abuse. 
In 1995, a New York State commission investigating the failure to prevent the death of a 
child victim determined that part of the blame was due to, “an appalling lack of 
communication and coordination among the agencies investigating reports of possible 
abuse.”194 in response, the commission recommended the creation of legislation 
facilitating the sharing of information among MDT members. 

The number of reports of child abuse and neglect has increased over the last 
several decades. The increase in cases has tested the limits of practitioners and agencies 
tasked with investigation and treatment. According to a report issued by the U.S. 
Department of Justice (DOJ), attention to these cases has assisted in focusing attention on 
the problem, but has also led to a spectrum of accusations varying from government 
overreach to government inaction. 195 

A. APPLICATION TO CVE 

When comparing the collaborative efforts of CVE programs with CACs, many 
structural and goal similarities appear. In Montgomery County, the MDT structure 
already exists, and many of the partners are the same as those involved in the county’s 


193 Montgomery County, Montgomery County Memorandum of Understanding and Operational 
Agreement for the Tree House Child Assessment Center of Montgomery County, Maryland (Montgomery 
County, MD: 2013). 

194 Ellis, Forming a Multidisciplinary Team to Investigate Child Abuse, 2. 

195 Ibid., 3. 
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CVE program. Child abuse and radicalization are both eomplex issues that require 
eollaborative solutions. In Maryland, the law was amended to allow for the 
eommunication between partners on ehild abuse MDTs.i^^ Other states have ereated or 
altered existing law for the same purpose. Aeeording to the Department of Criminal 
Justiee Serviees for the Commonwealth of Virginia, “MDT members ean share 
information. When the 2004 General Assembly made the above-referenced changes to 
section 63. 2-1503 (K) regarding the purpose and composition of child abuse and neglect 
MDTs, the specifically included language allowing team members to share 

information.”i97 

According to its strategic plan, the BRAVE model in place in Montgomery 
County describes itself as a CII.^^^ “Collective impact is a framework to tackle deeply 
entrenched and complex social problems. It is an innovative and structured approach to 
making collaboration work across government, business, philanthropy, non-profit 
organizations and citizens to achieve significant and lasting social change.The idea 
of a CII was first written about in the Stanford Social Innovation Review in 2011. 
According to the article, five key elements are needed for a successful program: a 
common agenda, shared measurements systems, mutually reinforcing activities, 
continuous communication, and a backbone support organization. See Eigure 6. 


State of Maryland, 22. Medical Records Act—Duty to Hold Confidential and Duty to Disclose a 
Medical Record, Health-General Article § § 4-301—4-309, 8-601. 

197 Virginia Department of Criminal Justiee Serviees, Information Sharing and the Multidisciplinary 
Child Abuse Team (Riehmond, VA: Department of Criminal Justiee Serviees, 2005), 2, https://www.dejs. 
virginia.gov/juvenile/resourees/infoSharing.pdf 

198 \yorld Organization for Resouree Development and Edueation (WORDE), The Building Resilience 
against Violent Extremism (BRAVE) Model—A Collective Impact Initiative That Increases Public Safety 
and Social Cohesion, 12. 

199 “Xhe Colleetive Impaet Framework | Collaboration for Impaet,” aeeessed Oetober 16, 2016, http:// 
www.eollaborationforimpaet.eom/eolleetive-impaet/. 
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Common Agenda 

• Keeps all parties moving towards the same goal 

Common Progress Measures 

• Measures that gert to the TRUE outcome 

Mutually Reinforcing Activities 

• Each expertise is leveraged as part of the overall 

Communications 

• This allows a culture of collaboration 

Backbone Organization 

• Takes on the role of managing collaboration 


Figure 6. Collective Impact Initiative.^°° 


CIIs are models that may be applied to organizational structures to ensure that 
practitioners are working together to achieve a common goal. The BRAVE model is 
currently the only true community led CVE initiative in existence. 

B. THE FBI’S SHARED RESPONSIBILITY COMMITTEES 

In the spring of 2016, media sources began reporting that the FBI had created 
SRCs that were being used as MDTs to control and facilitate the actions of CVE 
practitioners involved in intervention efforts with individuals referred by the FBI. One 
source, The Intercept, claimed to have a copy of a letter issued by the FBI to CVE 
members of SRCs. According to reports, and the letter itself, the FBI was seeking to 
create voluntary SRCs within CVE programs to define the boundaries and rules regarding 
individuals referred from the FBI .201 

According to The Intercept, George Washington University Professor Seamus 
Hughes advised: 


Source: “The Collective Impact Framework | Collaboration for Impact.” 

201 Cora Currier and Murtaza Hussain, “Letter Details FBI Plan for Secretive Anti-Radicalization 
Committees,” The Intercept, April 28, 2016, https://theintercept.eom/2016/04/28/letter-details-fbi-plan-for- 
secretive-anti-radicalization-committees/. 
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if implemented transparently, the SRCs could offer the promise of an “off 
ramp” for people on the road to radioalization or arrest. ‘We haven’t 
provided families with any tools to help them. Parents are taking passports 
away, bringing their kids to local imams, but these are ad hoc approaches 
set up to fail with no support system in place. Law enforcement is given 
very few options besides arrest. There are a lot of attacks on heavy-handed 
counter-terrorism approaches, like the informants and agent provocateurs, 
but that’s the status quo now until we have other options .202 

According to the letter, the FBI defines SRCs as, “multi-disciplinary groups 
voluntarily formed in local communities.”^03 The letter outlines how the FBI may refer 
“potentially violent extremists for intervention so long as the SRC operates within the 
FBI’s rules. ”304 xhe FBI has not confirmed the existence of the letter and has been 
accused of implementing the SRC program in secrecy. The FBI has admitted that the 
SRC program is a limited “pilot” program but has not confirmed where the program is 
being used.305 

According to the letter and media sources, the primary goal of the SRC is 
disengagement where the, “social and psychological process whereby an individual’s 
commitment to violence as a solution to a grievance is reduced to such an extent that 
he/she is no longer at risk of using violence as a solution to a grievance. The letter 
claims that the FBI’s goal in referring individuals to SRCs is not to alter political or 
religious beliefs. 

Some of the main points of the letter include the followingi^o^ 

• The FBI is not part of the SRC. 

• Once the FBI refers an individual, the SRC will decide if appropriate 
treatment may be applied. 


302 Hussain and McLaughlin, “FBI’s ‘Shared Responsibility Committees’ to Identify ‘Radicalized’ 
Muslims Raise Alarms.” 

203 “FBI-SRC-Letter,” April 28, 2016, https://www.documentcloud.org/documents/2815794-FBI- 
SRC-Letter.html. 

304 Ibid. 

305 Currier and Hussain, “Letter Details FBI Plan for Secretive Anti-Radicalization Committees.” 

306 “FBI-SRC-Letter.” 

307 Ibid. 
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The SRC will then be responsible for designing and implementing a 
treatment plan. 


A referral will not preelude the FBI from eondueting an investigation of 
the referred subjeet; however, the FBI will not use the SRC to gather 
intelligenee. 

The FBI will not share investigative details with the SRC. 

Any investigation or proseeution may be conducted without notifying the 
SRC. 

Once a referral has been made, members of the SRC may share 
confidential PHI in accordance with applicable law. 

SRC members will sign confidentiality agreements, which forbid members 
from discussing the FBI referrals with anyone outside of the SRC or FBI, 
to include other LE members. 

The onus is placed on SRC members to reasonable ensure any information 
passed back to the FBI is accurate. 

The FBI reserves the right to stop making referrals to the SRC. 

The SRC may share best practices with other SRCs. 

SRC members may not seek outside consultation with other experts on the 
treatment of referred individuals without the written consent of the FBI. 

The FBI will not disclose the identities of the SRC members unless legally 
required to do so (represents another form of risk for CVE practitioners). 

SRC members will be required to sign federal form EC-857 for instances 
when they are exposed to sensitive, although unclassified, information. 

The EBI and DOJ will provide yearly training to SRC members on the 
handling of sensitive information and materials. 

The SRC will share all information on the referred individuals who pose a 
threat of violence to any other individual, group, or the public in a manner 
consistent with applicable laws. 

The SRC will notify the FBI when a referred individual is not responding 
to treatment. 

SRC may notify the FBI of the progression of treatment. 
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• Any information shared with the FBI may then be passed on to other LE, 
members of the U.S. intelligenee eommunity, or representatives of foreign 
governments. 

• Finaneial and eivil liability resides with the SRC members who are 
required to provide their own insuranee and legal representation when 
needed. 

• The letter of agreement makes no promise of funding. 

Referrals made by the federal government of potentially radicalized individuals to 
SRCs would most likely represent a small but critical portion of treatment by CVE 
programs. The FBI certainly has an obligation to protect the integrity of its 
responsibilities. The manner the FBI has moved forward with SRCs and the construct of 
the agreement letter, however, do raise some concerns. For example, one of the main 
tenets of the CVE program is community outreach. Relationships between community 
and government, like all relationships, are based on trust. A semi-secret implementation 
of a program with such important consequences does not help this effort. According to 
the Muslim Public Affairs Council; 

This lack of transparency is harmful to the very goal the FBI is trying to 
achieve. Any individual who is being counseled by his/her imam, social 
worker, or therapist, will wonder if these individuals are working with the 
FBI—an entity that could very well arrest him/her and does not have any 
actual concern for his/her well-being.208 

The letter also appears to move the lion’s share of risk onto SRCs. This level of 
risk does not create an atmosphere where the most qualified practitioners would be most 
willing to partake in risky work that carries such an important role. The contents of the 
letter also do not create a trusting relationship between the FBI and the various public and 
private partners engaged in CVE endeavors. The letter also gives the FBI the appearance 
of hypocrisy. On one hand, the letter claims that the FBI will not use the SRC to gather 
intelligence, and then goes on to strictly set the rules mandating a one-way flow of 
information from the SCR to the FBI. Once again, the FBI has a responsibility to conduct 


208 Muslim Public Affairs Council, “The Problem with the FBI’s ‘Shared Responsibility 
Committees,’” Muslim Public Ajfairs Council, March 31, 2016, http://www.2fwww.mpac.org/policy- 
analysis/the-problem-with-the-fbis-shared-responsibility-committees.php. 
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its business, but the approaeh taken as outlined in the letter does not ereate a trusting and 
inelusive relationship. 

The FBI will possess a lot of information eoneerning its referrals, whieh it 
understandably will not be able to share. However, sueeessful treatment of referred 
persons also requires CVE praetitioners be informed of certain information concerning an 
individual for whom they will creating and implementing a treatment plan. The fact the 
FBI may continue, or begin, a criminal investigation of a referred individual without the 
SRC’s knowledge is understandable; however, the FBI’s lack of presence on the SRC is 
not. The bottom line in regards to the letter and the role of the FBI and SRC members is 
that it appears that the FBI wants its cake, and to eat it as well, and to deny any cake to 
anybody else. 

Much of the criticism of the FBI’s SRC program has come from civil liberty and 
watch dog agencies, such as the American-Arab Anti-Discrimination Committee (ADC) 
and the Muslim Public Affairs Council.209 The ADC has demanded that the FBI cancel 
the program.210 One of the main accusations is that the program is a front for the 
expansion of FBI informant networks. Unfortunately for the FBI and CVE programs, this 
accusation is easy to make. The appearance that the FBI is using professionals and 
communities to expand surveillance of specific communities may validate existing claims 
that CVE programs stigmatize and unfairly target certain portions of communities. This 
phenomenon also runs contrary to community engagement theories. 

The FBIs reference to CVE practitioners as an MDT may be technically accurate, 
but the FBI’s approach violates the spirit of MDTs. MDTs include all relevant 
practitioners who work together to solve problems by combining the expertise of all. By 
not including itself in the MDT, the FBI is excluding its expertise, and probably some 
information held that would be better served shared. 


209 “ADC Demands Cancellation of ‘Shared Responsibility Committees’ FBI Informant Program,” 
March 25, 2016, http://www.adc.org/2016/03/adc-demands-cancellation-of-shared-responsibility-committ 
ees-fbi-informant-program/; Muslim Public Affairs Council, “The Problem with the FBI’s ‘Shared 
Responsibility Committees.’” 

210 “ADC Demands Cancellation of ‘Shared Responsibility Committees’ FBI Informant Program.” 
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For all its good intentions, the design and roll out of the FBI SRC plan may do 
more harm than good. The FBI may be in a hurry to refer individuals to CVE programs, 
but not having the proper partners and relationships in plaee prior to kiek off is never 
advisable. The result may be distrust or an undermining of what the CVE program eould 
do to build relationships, help others, and proteet the eountry. 
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V. RECOMMENDATIONS AND CONCLUSION 


A number of common and repeated themes are inherent in the topic of this thesis. 
The issues of risk and threats to the community, community trust, delegation of roles, 
investigative restrictions, and importance of intelligence remain as challenges that must 
be addressed. 

One of the most important elements of a successful CVE program will involve 
assembling the right team and establishing relationships between the stakeholders. This 
researcher would refer to the definition in the newest SIP and re-iterate that this group 
involves the public, LE, mental health practitioners, government leaders, attorneys, 
educators, NGOs, and private entities. Each element must not only understand its own 
role, but the roles of others for the effort to succeed. The importance of the relationship 
with the public was discussed previously. Two of the most important groups that need to 
establish strong working relationships include the mental health practitioners and EE. The 
theory of therapeutic jurisprudence, as proposed by Wexler and Winick may help to 
explain the difference between the two fields, and the important relations between the 
two. Erequently, practitioners of each discipline do not understand the role of the other. 
As a result, the two fields tend to work independent of each other and view the other with 
suspicion. The truth is that both fields share basic values and missions. To gain the best 
results, practitioners from both fields need to depend on the expertise of the other to 
achieve a better result. Both disciplines must develop a true collaborative and 
understanding relationship for the best results to occur. Eortunately, this relationship 
occurs in other areas, such as drug and gang diversion programs and in CACs. 

Eor CVE intervention programs to operate successfully, stakeholders (using the 
same definition from the current SIP) must understand the law. The three areas of law 
(both federal and state) that have the greatest impact on CVE intervention programs 
include medical record confidentiality laws, national security laws, and duty to warn or 
protect laws. An analysis of the federal national security laws reveals that the impact of 
the Patriot Act’s Section 215 represents a smaller change than is expressed in literature. It 

is critical that stakeholders receive comprehensive training on these laws. As noted 
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earlier, many segments of government and the private seetor frequently hire outside 
experts to train their employees on sueh topies. The training should be provided to all 
stakeholders. It is important that stakeholders to whom the laws may not direetly apply, 
sueh as LE, understand the legal environment in whieh their partners must work. It is also 
important that the training be speeifie to the state in whieh the program is operating, and 
any neighboring states with whieh the program may overlap. 

A, CVE INTERVENTION PROGRAM ORGANIZATION 

CVE programs should study and apply the tenets of eollaborative models, sueh as 
CIIs and MDTs. CVE programs, in general, may benefit from a CII strueture. Eor more 
information on the BRAVE model, refer to its strategic plan.^n 

CVE intervention programs should be managed and run by a MDT comprised of 
the applicable professionals. Since the goal of an intervention program is provided by 
mental health professionals, the MDT should be led by an experienced mental health 
practitioner. The MDT would be tasked with screening and assigning patients for 
treatment. The team would then monitor progress and oversee the application of 
resources to the treatment plan. Once assigned to other professionals within the program, 
the MDT would stand back and monitor based on the advice of the treating professional. 

The MDT would also consist of EE and legal experts. The goal of the team would 
be to address any issues and make suggestions on plans to address the issues. The 
creation of the team, similar to MDTs used for child abuse investigations, would facilitate 
a cooperative working environment on the appropriate practitioners who would bring 
relevant experience to the effort. It is possible that states hosting CVE programs should 
study existing laws facilitating information sharing among MDT members engaged in 
responding to child abuse. In states that have created or altered laws to facilitate the 
sharing of otherwise protected information in these situations; similar laws may be 
needed for CVE intervention programs. 


211 World Organization for Resource Development and Education (WORDE), The Building Resilience 
against Violent Extremism (BRAVE) Model—A Collective Impact Initiative That Increases Public Safety 
and Social Cohesion. 
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The MDT would also monitor and respond to training needs for members of the 
program, allied partners, and the publie. The MDT would also be responsible for the 
application of HIPAA and state medical law requirements. 

Public and private entities involved in CVE, and specifically intervention, should 
consider the creation of a memorandum of understanding (MOU) between involved 
organizations. A MOU would describe roles and set rules prior to establishing a group 
effort. The MOU would benefit by setting rules and expectations prior to any 
disagreements. If a CVE program is going to accept referrals from the federal 
government, they may consider including the EBI and the U.S. Attorney’s Office in the 
MOU. Another option would be for the CVE itself to create a contract with the EBI 
(similar to a reverse SRC letter) to take the burden off of the EBI and stimulate a more 
fair perception of the process. The contract between the CVE program and the FBI would 
still acknowledge the responsibility the federal government has to protect the country, 
and balance the need for information with existing laws and regulations. The danger to 
the relationship between the federal government, local governments, and community led 
groups is the federal government’s tendency to use funding to ensure it gets what it 
wants. The federal government should limit itself to coordinating research and providing 
advice, collating research, funding, referrals, and traditional investigative efforts. The 
federal government should also stay focused on its correct assessment that local 
governments are better positioned to create community relationships and understand the 
needs at the local level. The expertise to put the elements of CVE into practice resides at 
the local level. 

B, MEDICAL CONFIDENTIALITY 

In relation to medical confidentiality laws, it is imperative that practitioners 
understand the existence of both the federal HIPAA law and specific state laws. In 
relation to HIPAA, stakeholders must understand that the Privacy Rule only identifies 
two mandatory disclosures of PHI, to the patient, and to DHHS for auditing purposes. 
The remaining exceptions provide permissible conditions for mental health practitioners 
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to share information. Relationships must be in plaee prior to the treatment of elients so 
that stakeholders understand the law and know who needs access to information. 

CVE programs must also determine if they constitute a hybrid entity and identify 
the part of the program that must operate under medical record laws. The program will 
then be responsible for segregating the portions of the program so that PHI remains 
secure. 

Programs involved in intervention and diversion efforts must then be prepared to 
notify their clients of the laws, and the impact of the laws on their treatment and 
confidential information. CVE programs will be responsible for creating and 
implementing policies and procedures to ensure the protection of PHI and training their 
employees. These programs are also responsible for designating employees to be 
responsible and accountable for the requirements. 

Programs will most likely advise clients of their privacy rights afforded by the 
Privacy Rule when they are first registered. It is an opportune time to ask the client for 
consent to share their PHI, and explain under what circumstances this sharing may be 
done. Consent is the easiest and cleanest practice that may address the issue of 
communication among stakeholders. The process must include a written waiver 
completed by the client. The waiver must include the length of the consent and under 
what circumstances it may be revoked. Under Maryland law, the consent process is 
described under §4-303.212 

CVE practitioners may also consider the use of de-identified PHI used in a “safe 
harbor” method of sharing when consulting with other stakeholders as long as the 
information does not identify the client. It is a limited use of PHI, but one that may be 
considered when other options are not available. 

Eike the Privacy Rule, Maryland state laws on medical record confidentiality are 
permissive in nature. Maryland law is broader than the federal law in regards to whom 
PHI may be shared. Maryland law allows for the disclosure of PHI to any government 

212 State of Maryland, 22. Medical Records Act—Duty to Hold Confidential and Duty to Disclose a 
Medical Record, Health-General Article § § 4-301—4-309, 8-601. 
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agency conducting authorized actions (as described by law). Practitioners will be 
challenged when blending state and federal law. Maryland law also allows for the release 
of information for an investigative process. The law does stipulate that the receiving 
agency must have written policies in place to protect the information. Many LE agencies 
do not have written procedures for the protection and safe storing of PHI. As a result, LE 
agencies involved in CVE actions must create these types of policies. 

Practitioners in Maryland must also understand that they must disclose, or not 
disclose, PHI in compliance with the law to be immune from civil action. 

C. DUTY TO WARN AND PROTECT 

As with medical confidentiality laws, training on duty to warn and protect laws 
will be critical for mental health practitioners involved in CVE intervention and 
diversion. 

CVE intervention programs will be run and performed by mental health 
professionals. These experts should already be well versed on the ethical and legal 
conditions imposed upon their work. The practitioners may not, however, have 
experience working with other professionals from other disciplines. They also may not be 
well versed on the exceptions to confidentiality in relation to the threat presented by 
radicalized persons. 

Since duty to warn and duty to protect laws reside at the state level, practitioners 
must be aware of the laws of the state where they are practicing. Additionally, many laws 
are written in a broad manner that does not clearly articulate what is forbidden, mandated, 
or allowed. Many of these laws, such as Maryland’s, allow for discretion. Mental health 
practitioners must have access to legal experts to assist in deciphering and applying the 
law, which is especially important when situations are frequently not the same. 

Mental health professionals have an obligation to their clients. Due to the special 
relationship between mental health professionals and their clients, they may also have a 
legal obligation to protect third parties from the actions of their clients. This balance of 
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confidentiality needed to provide mental health treatment successfully must be balanced 
with any threat to the publie. 
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